Disabled plugin still appears in available skills and can be invoked

Bug

A plugin explicitly disabled in user-level settings (~/.claude/settings.json) is still listed in the available skills system reminder and can be invoked by the assistant.

Steps to Reproduce

1. Disable a plugin in ~/.claude/settings.json:

``json
{
"enabledPlugins": {
"code-review@claude-plugins-official": false
}
}
``

1. Start a conversation and ask for a code review.
2. The disabled code-review skill still appears in the <system-reminder> skills list.
3. The assistant invokes the skill despite it being disabled.

Expected Behavior

• Disabled plugins should not appear in the available skills list injected into system reminders.
• If a disabled skill is somehow invoked, the Skill tool should reject the call.

Actual Behavior

• The disabled plugin appears in the skills list as if it were enabled.
• The assistant invokes it without any guardrail preventing execution.

Notes

User-level settings should take precedence over project-level settings. The enabledPlugins: false directive at the user level was ignored entirely.