refactor: convert mac-optimizer from raw skill to proper plugin

Restructured 92-mac-optimizer from a CLAUDE.md-based skill into a full
Claude Code plugin with .claude-plugin/plugin.json, 6 slash commands
(/mac-doctor, /mac-packages, /mac-environment, /mac-security,
/mac-cleanup, /mac-resources), and auto-trigger SKILL.md.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

custom-skills/92-mac-optimizer/skills/mac-optimizer/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: mac-optimizer
+description: macOS system health toolkit — use when user mentions system optimization, cleanup, packages, security audit, disk space, performance, brew updates, cache clearing, or system health on Mac
+version: 1.0.0
+---
+
+# Mac Optimizer
+
+Modular macOS system health toolkit. Runs read-only audits first, then recommends actions with user consent.
+
+## Module Routing
+
+| Keywords | Command |
+|---|---|
+| brew, homebrew, npm, nvm, pip, pyenv, packages, update, outdated | /mac-packages |
+| path, shell, zshrc, environment, env, config, symlink | /mac-environment |
+| security, firewall, sip, gatekeeper, filevault, ports, ssh | /mac-security |
+| cache, cleanup, clean, logs, clutter, disk space, free space, trash | /mac-cleanup |
+| cpu, memory, ram, disk, battery, processes, resources, slow | /mac-resources |
+| doctor, audit, health, full check, everything, system check | /mac-doctor (all) |
+
+Default to **/mac-doctor** when the request is ambiguous.
+
+When the user's request matches a specific module, suggest the appropriate slash command. When the request is broad (e.g., "check my system", "run a health check"), use /mac-doctor.
+
+## Execution Model
+
+Every module follows this flow:
+
+1. **Audit** — run the module's script (read-only)
+2. **Report** — parse JSON output, present findings as a severity-ranked table
+3. **Recommend** — list available actions grouped by risk
+4. **Consent** — ask user which actions to approve
+5. **Act** — execute only approved actions
+
+## Safety Rules
+
+- **Never execute cleanup without explicit user approval**
+- **Always show sizes before deleting anything**
+- **Security module is read-only** — present findings and remediation guidance only
+- **Back up shell configs** before modifying
+- **Process deny-list**: never suggest killing kernel_task, launchd, WindowServer, loginwindow, mds, mds_stores, opendirectoryd, coreaudiod, SystemUIServer, Finder, Dock
+- **No sudo by default** — if an action needs sudo, state why and ask first
+- Docker cleanup uses `docker system prune`, never direct file deletion