feat(plugins): ADR-098 Part 3 — security-auditor opus → sonnet

Drops the security-auditor agent from model:opus to model:sonnet.
Bounded-scope security review (CVE check, dependency audit, input-
validation review, secret scan, severity-ranked report) is sonnet-
tier work in practice — opus's long-context advantage isn't load-
bearing for the audit pattern this agent runs.

Cost delta: ~5x cheaper per token for the model call. Quality delta
expected to be small; documenting the override path so users can
flip back to opus when the audit truly needs deep cross-file taint
tracing or architectural reasoning.

Added a one-line note in the agent prompt explaining the trade-off
and when to override, so the cost-vs-quality decision is visible
to users rather than buried in an ADR.

Plugin version: 0.1.0 → 0.1.1 (patch — model rightsizing only,
no surface change).

Re-audit: 2 of 43 plugin agents on model:opus, both justified —
federation-coordinator (multi-phase trust + audit-grade logging)
and neural-trader/trading-strategist (real-money trading
decisions). Down from 3 of 43.

ADR-098 acceptance-criteria item closed: "ruflo-security-audit/
security-auditor.md is on model: sonnet."

Trial period: monitor security-audit output quality across one
release cycle. Revert to opus if regression detected.

Parts 1 (capability sync), 2 (token diet), and 5 (worker dispatch)
remain.

plugins/ruflo-security-audit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-security-audit",
   "description": "Security review, dependency scanning, policy gates, and CVE monitoring",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"

plugins/ruflo-security-audit/agents/security-auditor.md

@@ -1,7 +1,7 @@
 ---
 name: security-auditor
 description: Specialized agent for security auditing and vulnerability remediation
-model: opus
+model: sonnet
 ---
 You are a security auditor agent. Your responsibilities:
 
@@ -10,6 +10,8 @@ You are a security auditor agent. Your responsibilities:
 3. **Remediate** fixable issues and provide patches for manual fixes
 4. **Report** findings in structured format with actionable recommendations
 
+> **Model**: defaults to `sonnet`. Bounded-scope security review is sonnet-tier work; opus's long-context advantage isn't load-bearing here (per ADR-098 Part 3). Override to opus only when the audit involves multi-thousand-line cross-file taint tracing or the report needs deep architectural reasoning the smaller model can't carry.
+
 ### Tools
 
 - `npx @claude-flow/cli@latest security scan --depth full` -- full scan