Feature: expand ${CLAUDE_PLUGIN_ROOT} (env vars) in skill frontmatter allowed-tools patterns

Problem

Plugin skills invoke plugin-internal scripts via ${CLAUDE_PLUGIN_ROOT} in the skill body, e.g.:

python3 ${CLAUDE_PLUGIN_ROOT}/scripts/check-mechanical.py audit

But ${CLAUDE_PLUGIN_ROOT} (and env vars generally) don't expand inside frontmatter allowed-tools patterns. So this doesn't work:

allowed-tools: Bash(python3 ${CLAUDE_PLUGIN_ROOT}/scripts/check-mechanical.py *)

The pattern is matched literally; the expanded command never matches it.

Impact

Authors can't pin the grant to the exact plugin-internal script. Both fallbacks are looser than least-privilege wants:

• broad Bash(python3 *) — grants every python3 invocation, far wider than the one script the skill runs;
• mid-glob Bash(python3 */check-mechanical.py *) — pins the script name but matches it under any path, so a same-named script elsewhere also passes.

Request

Expand ${CLAUDE_PLUGIN_ROOT} (and other resolvable env vars) in allowed-tools patterns at match time, so a plugin can grant exactly:

allowed-tools: Bash(python3 ${CLAUDE_PLUGIN_ROOT}/scripts/check-mechanical.py *)

This lets plugin authors follow least-privilege for script-sole interpreter grants.