chore(claude): track claude-security plugin as enabled

[toku345]

Summary

The deployed ~/.claude/settings.json has carried claude-security@claude-plugins-official: true since the plugin was enabled at runtime, but the chezmoi source was never updated to match. Running chezmoi apply would therefore have silently disabled the plugin.

This records the entry in source so the managed source and the deployed file agree.

Why now

The drift surfaced while reviewing an unrelated change: chezmoi diff on ~/.claude/settings.json showed a third hunk removing this line, which had nothing to do with the change under review. Kept separate from that work deliberately.

Verification

• python3 -c "json.load(...)" — file parses; enabledPlugins gains exactly one entry
• python3 tests/codex/verify_claude_update_policy.py — OK: Claude/Codex update policy source settings match ADR 0026
• After this commit the source blob is 0dd8bd7, byte-identical to the currently deployed ~/.claude/settings.json, so chezmoi diff for this file is now empty

Risk

None to behaviour: the deployed state is unchanged. This only stops a future chezmoi apply from reverting it.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

Records the already-deployed Claude security plugin in the chezmoi-managed settings source, preventing a future chezmoi apply from disabling it.

• Enables claude-security@claude-plugins-official in enabledPlugins.
• Leaves the deployed behavior unchanged while eliminating source-state drift.

Confidence Score: 5/5

The PR appears safe to merge because it synchronizes the managed settings with an already-active plugin and introduces no identified failure.

The new entry is valid JSON, does not conflict with the repository’s plugin update-policy checks, and preserves the documented deployed configuration.

Important Files Changed

Filename	Overview
private_dot_claude/settings.json	Adds one valid official-marketplace plugin entry without violating repository plugin or update-policy constraints.

_{Reviews (1): Last reviewed commit: "chore(claude): track claude-security plu..." | Re-trigger Greptile}