refactor: convert mac-optimizer from raw skill to proper plugin

Restructured 92-mac-optimizer from a CLAUDE.md-based skill into a full
Claude Code plugin with .claude-plugin/plugin.json, 6 slash commands
(/mac-doctor, /mac-packages, /mac-environment, /mac-security,
/mac-cleanup, /mac-resources), and auto-trigger SKILL.md.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

custom-skills/92-mac-optimizer/commands/mac-doctor.md

@@ -0,0 +1,60 @@
+---
+allowed-tools: Bash(bash *audit_*.sh*), Bash(bash *cleanup_execute.sh*), Bash(du *), Bash(df *), Bash(brew *), Bash(npm *), Bash(pip *), Bash(docker *), Bash(cp *)
+description: Full macOS system health check — runs all 5 audit modules and presents unified findings
+---
+
+## Your task
+
+Run a full macOS system health check using all 5 audit modules. Follow this workflow exactly:
+
+### Step 1 — Run all audits
+
+Run these scripts sequentially, collecting all JSON output:
+
+```bash
+bash $CLAUDE_PLUGIN_ROOT/skills/mac-optimizer/scripts/audit_packages.sh
+bash $CLAUDE_PLUGIN_ROOT/skills/mac-optimizer/scripts/audit_environment.sh
+bash $CLAUDE_PLUGIN_ROOT/skills/mac-optimizer/scripts/audit_security.sh
+bash $CLAUDE_PLUGIN_ROOT/skills/mac-optimizer/scripts/audit_cleanup.sh
+bash $CLAUDE_PLUGIN_ROOT/skills/mac-optimizer/scripts/audit_resources.sh
+```
+
+If a script exits non-zero, report the error and continue with other modules.
+
+### Step 2 — Parse and report
+
+Parse all JSON lines. Each has: `{"module":"...","severity":"...","finding":"...","action":"...","details":"..."}`
+
+Present findings grouped by severity (critical first, then warning, then info) as markdown tables:
+
+```
+### Critical
+| Module | Finding | Recommended Action |
+|---|---|---|
+
+### Warning
+| Module | Finding | Recommended Action |
+|---|---|---|
+
+### Info
+| Module | Finding | Recommended Action |
+|---|---|---|
+```
+
+### Step 3 — Ask for consent
+
+STOP and ask: "Which actions would you like me to perform? You can approve by category (e.g., 'update packages and clean caches') or review each item."
+
+### Step 4 — Execute approved actions only
+
+For cleanup actions, always run `--dry-run` first and show what will happen before running `--execute`.
+
+### Safety rules
+
+- Never execute cleanup without explicit user approval
+- Always show sizes before deleting anything
+- Security module is read-only — present findings and remediation guidance only
+- Back up shell configs before modifying: `cp ~/.zshrc ~/.config/mac-optimizer-backups/.zshrc.$(date +%s)`
+- Process deny-list: never suggest killing kernel_task, launchd, WindowServer, loginwindow, mds, mds_stores, opendirectoryd, coreaudiod, SystemUIServer, Finder, Dock
+- No sudo by default — if an action needs sudo, state why and ask first
+- Docker cleanup uses `docker system prune`, never direct file deletion