fix(claude): inventory designated config workspaces

[phodal]

Summary

• treat a selected Claude config root as project-authorized evidence instead of probing a nested .claude/.claude path
• inventory root-level Skills, Commands, Hooks, Rules, and contained enabled Plugins without requiring --include-user-home
• preserve the privacy boundary for adjacent Claude state, external Plugin roots, and symlink escapes

Root cause

The Claude provider always resolved project assets from <workspace>/.claude/* and gated <claudeHome>/* behind user-home authority. When the selected workspace was the Claude config root itself, both rules applied in the wrong direction: project discovery looked one directory too deep while the real root assets were suppressed.

Impact

Agent Customize now reports the assets physically contained by an explicitly selected Claude config workspace. The public authority remains scope.includeUserHome: false, and ordinary project workspaces retain their existing <workspace>/.claude/* behavior.

Validation

• node --test test/agent-customize.test.mjs test/agent-asset-baseline.test.mjs test/agent-lint.test.mjs test/better-harness-evidence-bundle.test.mjs — 87/87
• node --test test/doc-link-graph.test.mjs — 6/6
• npm test — 1095/1095
• npm run pack:verify — 382 npm entries, 405 runtime ZIP entries

Risk boundaries

Regression fixtures cover an adjacent state file, an external Plugin root, a symlink-escaping Plugin root, a canonical workspace alias, and the normal Claude project layout.

Fixes #42