ralph-wiggum commands use unrecognized frontmatter key hide-from-slash-command-tool, so the model can invoke /ralph-loop

plugins/ralph-wiggum/commands/ralph-loop.md and cancel-ralph.md both set:

hide-from-slash-command-tool: "true"

This key is not documented anywhere; the repo's own frontmatter reference (plugins/plugin-dev/skills/command-development/references/frontmatter-reference.md) documents disable-model-invocation as the key that prevents the model from invoking a command via the Skill tool. The CLI accepts hide-from-slash-command-tool silently (it is in the known-keys list, so no warning is shown) but never reads its value.

Consequence: the model can invoke /ralph-loop on its own. That is the one command the author clearly intended to keep user-only, since a self-invoked Ralph loop starts an infinite loop.

Verified live on Claude Code v2.1.215 with a scratch project containing two identical test commands, one per key:

• command with hide-from-slash-command-tool: "true": a headless session asked to invoke it via the Skill tool succeeded and returned the command output. Not hidden.
• command with disable-model-invocation: true: the same probe reported the skill is not in the model's available list. Hidden as intended.
• typing the disable-model-invocation command as a user (claude -p "/test-cmd") still works, so the user-facing path is unaffected.

Fix is a two-line frontmatter change replacing the key in both files. Happy to open a PR.