job6: supply-chain documentation pass (F-X1, semgrep caveat)

- README + plugins.lock.json graphifyy note: pipx/PyPI install only, never
  npm/npx — a different publisher (rhanka/graphify) squats the same
  'graphifyy' name on npm as a version-shadowing shim with its own
  conflicting 'graphify' bin (F-X1).
- agents/security-auditor.md: one-line caveat that p/* semgrep packs are
  fetched from the registry at runtime — the CLI version pin does not
  freeze ruleset content, so a new BLOCK can appear on unchanged code.

MCP magic (F-X3): version pin declined by user call (stays @latest in
lib/toggle-external.sh). ${VAR} env expansion confirmed unsupported at
~/.claude.json user scope (Claude Code docs — expansion is .mcp.json
project-scope only), so the BDR-026 reference-not-plaintext pattern
doesn't transfer here; existing mitigations (canonical ~/.claude/.env,
gitignore, audit env-field filtering) remain the practical ceiling.
~/.claude.json regenerated out-of-repo via toggle-external.sh disable+
enable magic to pick up the already-rotated MAGIC_API_KEY (no repo diff,
no commit for that file — traced in the job6 final report).

agents/security-auditor.md

@@ -60,6 +60,10 @@ non-deterministic gate). owasp-top-ten is REQUIRED, not optional: measured
 2026-07-03, the two-ruleset baseline missed SQL injection and path traversal
 entirely on realistic Flask code; owasp-top-ten's taint rules catch them.
 
+Caveat: `p/*` packs are fetched from the registry at RUNTIME — pinning the
+`semgrep` CLI version (`plugins.lock.json`) does NOT freeze ruleset content;
+a new BLOCK can appear on unchanged code even with the CLI pin untouched.
+
 **Severity mapping** (from `results[].extra.severity` + ruleset origin):
 
 | semgrep | origin | → gate severity | blocks? |