chore(scripts): flip check-unused-bash-grant.sh to --strict (blocking)

[laurigates]

What

Flip scripts/check-unused-bash-grant.sh from advisory to blocking by adding --strict at its two call sites:

• .pre-commit-config.yaml → entry: ./scripts/check-unused-bash-grant.sh --strict
• .github/workflows/plugin-pr-checks.yml → run: bash scripts/check-unused-bash-grant.sh --strict

Why it is a follow-up rather than part of #2254

#2254 landed the lint plus the triage in one pass: 5 genuinely-unused Bash grants removed, ISSUE_COUNT=0, allowlist empty. So the flip is a one-word change and the ratchet would hold today.

It is deliberately deferred one cycle so real use can surface a false positive I did not hit. The detector already produced one in its first run against the corpus (comfy-subgraphs-app-mode runs <venv>/bin/python … — a real command behind a placeholder path prefix), which is the class of miss worth waiting for. A blocking lint that false-positives blocks every commit touching a SKILL.md.

Gate before flipping

bash scripts/check-unused-bash-grant.sh          # expect STATUS=OK ISSUE_COUNT=0
bash scripts/check-unused-bash-grant.sh --strict # expect exit 0
bash scripts/tests/test-check-unused-bash-grant.sh

Flip only while ISSUE_COUNT=0 and UNUSED_BASH_GRANT_ALLOWLIST is still empty — a non-empty allowlist means the finding set was suppressed rather than resolved, and the ratchet would be locking in an exception instead of a clean state.

Refs #2254, #2250