fix(install,session-start): enable always-on plugins + truthful banner

Two interlocked bugs masking each other:

1. install-plugins.sh installed but never enabled marketplace plugins.
   `claude plugin install` only writes to ~/.claude/plugins/cache; without
   a separate `claude plugin enable` the plugin sits dormant in the
   user's enabledPlugins map. security-guidance and superpowers shipped
   as ALWAYS-ON in CLAUDE.md/README/installer banner but in practice
   landed disabled on every fresh install.

2. session-start.sh hardcoded the literal "security-guidance rtk
   superpowers" in the ✅ ON row, so the misleading banner agreed with
   the misleading documentation. The bug stayed invisible.

Fixes:
  - install-plugins.sh now calls enable_plugin (added in the caveman
    commit) for security-guidance and superpowers immediately after
    install. Idempotent: skips if already in enabledPlugins.
  - session-start.sh builds the ALWAYS-ON row dynamically from RTK
    binary detection + plugin_enabled() lookups against
    settings.json. Plugins that are not enabled are omitted, so the
    banner reflects reality. Wider strings split across two lines like
    the toggle row.
  - settings.json: ship security-guidance and superpowers in
    enabledPlugins so this user's machine matches the contract until
    install-plugins.sh runs again.

Out of scope (separate bug, not addressed here): the marketplace-aware
detect_security_guidance / detect_plugin_dev cache scans miss plugins
nested under cache/<marketplace>/<plugin>/<version>/. They aren't on
the always-on path so the symptom is hidden — left for a follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

install-plugins.sh

@@ -390,6 +390,7 @@ claude plugin marketplace add anthropics/claude-code 2>/dev/null || true
 info "Adding Anthropic skills marketplace..."
 claude plugin marketplace add anthropics/skills 2>/dev/null || true
 install_plugin "security-guidance"  "claude-code-plugins"
+enable_plugin  "security-guidance"  "claude-code-plugins"
 # skill-creator is in "example-skills" plugin from anthropics/skills marketplace
 # (not in claude-code marketplace — it's a separate repo)
 install_plugin "example-skills"     "anthropic-agent-skills"
@@ -402,6 +403,7 @@ echo ""
 info "Adding Superpowers marketplace..."
 claude plugin marketplace add obra/superpowers-marketplace 2>/dev/null || true
 install_plugin "superpowers" "superpowers-marketplace"
+enable_plugin  "superpowers" "superpowers-marketplace"
 
 echo ""