job6: supply-chain documentation pass (F-X1, semgrep caveat)

- README + plugins.lock.json graphifyy note: pipx/PyPI install only, never
  npm/npx — a different publisher (rhanka/graphify) squats the same
  'graphifyy' name on npm as a version-shadowing shim with its own
  conflicting 'graphify' bin (F-X1).
- agents/security-auditor.md: one-line caveat that p/* semgrep packs are
  fetched from the registry at runtime — the CLI version pin does not
  freeze ruleset content, so a new BLOCK can appear on unchanged code.

MCP magic (F-X3): version pin declined by user call (stays @latest in
lib/toggle-external.sh). ${VAR} env expansion confirmed unsupported at
~/.claude.json user scope (Claude Code docs — expansion is .mcp.json
project-scope only), so the BDR-026 reference-not-plaintext pattern
doesn't transfer here; existing mitigations (canonical ~/.claude/.env,
gitignore, audit env-field filtering) remain the practical ceiling.
~/.claude.json regenerated out-of-repo via toggle-external.sh disable+
enable magic to pick up the already-rotated MAGIC_API_KEY (no repo diff,
no commit for that file — traced in the job6 final report).

README.md

@@ -84,6 +84,11 @@ ctx7 login                 # optional: OAuth / API key for higher rate limits
 
 Versions are pinned in `plugins.lock.json`. To update: edit the file, then re-run `install-plugins.sh`.
 
+Graphify installs via **pipx/PyPI only, never npm/npx**: a different publisher
+squats the same `graphifyy` name on npm (version-shadowing shim re-exporting
+a different package, ships its own conflicting `graphify` bin) — see
+`plugins.lock.json`'s `graphifyy` note.
+
 ---
 
 ## Slash commands