chore(config): security-guidance Stop review off, plugins off, routing and docs

settings.json: ENABLE_STOP_REVIEW=0 (the plugin's own switch: no more
Opus call on every turn that changes code, 0 findings in 6 days, 1
recorded false positive; the regex layer and the commit/push agentic
review stay on), brightdata-plugin@synced false (keyless-useless, its MCP
skill would hijack WebFetch/WebSearch), frontend-design official plugin
entry gone (uninstalled: byte-identical to the managed copy).

CLAUDE.global.md routes Ship/PR to ship-feature (gstack ship takes
origin/HEAD = main as base), drops ship/context-save from the gstack-off
list and 21st-ui-review from the design review line (trio is max-only).
deploy's table no longer points at land-and-deploy/setup-deploy.
plugin-advisor.md describes security-guidance's real mechanics. CHANGELOG
Unreleased entry with a Known residual section.

skills/deploy/SKILL.md

@@ -58,8 +58,7 @@ jq dependency.
 |-----------|-------|
 | Run this project's deploy runbook, delta-instantiated, learning | **this skill** |
 | Project has no `.claude/deploy/PROCEDURE.md` yet | this skill's **bootstrap** branch (see STEP 0) |
-| Merge a branch + trigger CI deploy (gstack) | `/land-and-deploy` |
-| Configure deployment settings | `/setup-deploy` |
+| Merge a finished branch | `gitflow finish` on an explicit human signal (skills/gitflow) |
 | Document a release after shipping | `/document-release`, `/doc` |
 
 ## Artifacts — `.claude/deploy/` (four files)