disk-hygiene: setup:check reports healthy while the engine is dead (misses #376 env-injection and bare-python failures)

[kyle-sexton]

Summary

disk-hygiene:setup check probes prerequisites but never exercises the guard end-to-end, so it
reports all-PASS while the engine is actually dead — including the exact failure this session
hit (#376) and the python-launch risk (see the bare-python hook issue).

Details

• skills/setup/SKILL.md:20-46 probes Python 3.11+, conditional Git, the OS-family lane, and the
  disk_hygiene_enabled toggle.
• It never confirms that the guard hook process actually receives CLAUDE_PLUGIN_DATA (the disk-hygiene: skill-frontmatter guard reads CLAUDE_PLUGIN_DATA from env but never receives it -> engine lane fails closed on all platforms #376
  failure), and never confirms the hook's own interpreter (command: "python") resolves.

So a Windows/macOS/Linux user whose skill-frontmatter hook doesn't get plugin env (or whose python
doesn't resolve) gets a green setup:check while every guarded scan dead-ends.

Suggested fix

Add end-to-end probes to check:

1. Run the guard against a synthetic bare-python scan denial and assert the data-root disclosure is
   present (i.e. CLAUDE_PLUGIN_DATA reached the hook process).
2. Assert the hook's configured interpreter resolves to Python 3.11+.
3. Report a clear FAIL with remediation when either is missing, instead of a misleading PASS.

Severity

MEDIUM — the diagnostic tool fails to diagnose the plugin's actual, most common failure mode.
Related: #376, and the bare-python hook-launch issue.