fix(install,session-start): enable always-on plugins + truthful banner

Two interlocked bugs masking each other:

1. install-plugins.sh installed but never enabled marketplace plugins.
   `claude plugin install` only writes to ~/.claude/plugins/cache; without
   a separate `claude plugin enable` the plugin sits dormant in the
   user's enabledPlugins map. security-guidance and superpowers shipped
   as ALWAYS-ON in CLAUDE.md/README/installer banner but in practice
   landed disabled on every fresh install.

2. session-start.sh hardcoded the literal "security-guidance rtk
   superpowers" in the ✅ ON row, so the misleading banner agreed with
   the misleading documentation. The bug stayed invisible.

Fixes:
  - install-plugins.sh now calls enable_plugin (added in the caveman
    commit) for security-guidance and superpowers immediately after
    install. Idempotent: skips if already in enabledPlugins.
  - session-start.sh builds the ALWAYS-ON row dynamically from RTK
    binary detection + plugin_enabled() lookups against
    settings.json. Plugins that are not enabled are omitted, so the
    banner reflects reality. Wider strings split across two lines like
    the toggle row.
  - settings.json: ship security-guidance and superpowers in
    enabledPlugins so this user's machine matches the contract until
    install-plugins.sh runs again.

Out of scope (separate bug, not addressed here): the marketplace-aware
detect_security_guidance / detect_plugin_dev cache scans miss plugins
nested under cache/<marketplace>/<plugin>/<version>/. They aren't on
the always-on path so the symptom is hidden — left for a follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hooks/session-start.sh

@@ -123,7 +123,29 @@ unset _passive_t _budget_pct _budget
 
 echo ""
 echo "┌─ Claude Code config ──────────────────────────────────┐"
-printf "│  ✅ ON  : %-40s│\n" "security-guidance rtk superpowers"
+# "ALWAYS ON" row — actual state, not hardcoded. RTK is a binary on PATH;
+# the others are marketplace plugins whose state lives in
+# settings.json:enabledPlugins. Anything missing/disabled is omitted so
+# the user sees the real picture instead of a misleading literal.
+ALWAYS_ON=()
+detect_rtk &>/dev/null && ALWAYS_ON+=("rtk")
+plugin_enabled "security-guidance@claude-code-plugins"  && ALWAYS_ON+=("security-guidance")
+plugin_enabled "superpowers@superpowers-marketplace"    && ALWAYS_ON+=("superpowers")
+plugin_enabled "caveman@caveman"                        && ALWAYS_ON+=("caveman")
+ALWAYS_ON_STR="${ALWAYS_ON[*]:-none}"
+# Same 40-char-width split policy as the toggle row below — keeps the
+# right border aligned when 4 always-on plugins overflow the field.
+if [ "${#ALWAYS_ON_STR}" -le 40 ]; then
+  printf "│  ✅ ON  : %-40s│\n" "$ALWAYS_ON_STR"
+else
+  _ao_line1="${ALWAYS_ON[0]} ${ALWAYS_ON[1]} ${ALWAYS_ON[2]:-}"
+  _ao_rest=("${ALWAYS_ON[@]:3}")
+  _ao_line2="${_ao_rest[*]}"
+  printf "│  ✅ ON  : %-40s│\n" "$_ao_line1"
+  printf "│             %-40s│\n" "$_ao_line2"
+  unset _ao_line1 _ao_line2 _ao_rest
+fi
+unset ALWAYS_ON ALWAYS_ON_STR
 # Plugin display — all plugins shown, split across 2 lines if >4
 _active_count=${#TOGGLE_ACTIVE[@]}
 _inactive_count=${#TOGGLE_INACTIVE[@]}

install-plugins.sh

@@ -390,6 +390,7 @@ claude plugin marketplace add anthropics/claude-code 2>/dev/null || true
 info "Adding Anthropic skills marketplace..."
 claude plugin marketplace add anthropics/skills 2>/dev/null || true
 install_plugin "security-guidance"  "claude-code-plugins"
+enable_plugin  "security-guidance"  "claude-code-plugins"
 # skill-creator is in "example-skills" plugin from anthropics/skills marketplace
 # (not in claude-code marketplace — it's a separate repo)
 install_plugin "example-skills"     "anthropic-agent-skills"
@@ -402,6 +403,7 @@ echo ""
 info "Adding Superpowers marketplace..."
 claude plugin marketplace add obra/superpowers-marketplace 2>/dev/null || true
 install_plugin "superpowers" "superpowers-marketplace"
+enable_plugin  "superpowers" "superpowers-marketplace"
 
 echo ""
 

settings.json

@@ -238,7 +238,9 @@
   "enabledPlugins": {
     "example-skills@anthropic-agent-skills": true,
     "ui-ux-pro-max@ui-ux-pro-max-skill": true,
-    "caveman@caveman": true
+    "caveman@caveman": true,
+    "security-guidance@claude-code-plugins": true,
+    "superpowers@superpowers-marketplace": true
   },
   "extraKnownMarketplaces": {
     "claude-code-plugins": {