fix(cc-config): stop pinning CLAUDE_CONFIG_DIR in the bootstrap's plugin installer too

skill-plugins.js carried its own copy of the unconditional pin, with the
same comment claiming it keeps writes where cc-discovery reads. Same rule
as runClaude now: pin only when the operator set CLAUDE_HOME.

Also corrects three comments that described the old behaviour — the
confidently-wrong pair at these two call sites is what let two readers
believe reads and writes were aligned when they were not.

server/lib/skill-plugins.js

@@ -119,20 +119,24 @@ function missingSkillPlugins() {
  * because every argv element below comes from {@link AUTO_INSTALLABLE} — a
  * constant in this file, never a request or a template.
  *
- * Still an argv array, never a shell string, and `CLAUDE_CONFIG_DIR` is pinned
- * to the same home `cc-discovery` reads so a write here is a write the
- * dashboard can see.
+ * Still an argv array, never a shell string. `CLAUDE_CONFIG_DIR` is pinned
+ * only when the operator set `CLAUDE_HOME`, matching `cc-plugin-cli.js`'s
+ * `runClaude()`: left unset, the CLI's own defaults already write where
+ * `cc-discovery` reads, and pinning it unconditionally sent `.claude.json`
+ * to `~/.claude/.claude.json`, which nothing reads.
  *
  * @returns {{ok: boolean, output: string}}
  */
 function runClaudePlugin(args, timeoutMs) {
+  const env = { ...process.env };
+  if (process.env.CLAUDE_HOME) env.CLAUDE_CONFIG_DIR = getClaudeHome();
   const result = spawnSync("claude", args, {
     timeout: timeoutMs,
     encoding: "utf8",
     maxBuffer: 1024 * 1024,
     // Non-interactive: a would-be prompt must fail fast, not hang out the timeout.
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, CLAUDE_CONFIG_DIR: getClaudeHome() },
+    env,
   });
   const output = `${result.stdout || ""}${result.stderr || ""}`.trim();
   if (result.error) {