fix(user-interface): name the settings source so design never searches its plugin root

.changes/user-interface/fix-11980-plugin-root-search-9b2d4e17.md

@@ -0,0 +1,13 @@
+---
+bump: patch
+---
+
+### Fixed
+
+- `/user-interface:design` says where its settings come from when detect cannot run (no shell, as
+  in an eval run, or no `node`): `reference/defaults.yaml`. It reaches plugin files only by the
+  paths it and `concerns.json` name and never searches the plugin's root, which the eval
+  sandbox denies. The animation catalog names both sources of its
+  resolved `animation:` config, detect's `config.values.animation` and the defaults file. Eval
+  runs had searched the plugin root for those values, and the sandbox's denials made both sides
+  invalid ([#11980](https://github.com/melodic-software/claude-code-plugins/issues/11980)).

plugins/user-interface/reference/animation/catalog.md

@@ -3,6 +3,8 @@
 The rules for whether a piece of interface should move and, if it should, with which ingredients.
 The project's design system, motion tokens and conventions override everything in this file, and
 the values in the resolved `animation:` config fill only what the project leaves undefined.
+That config is `config.values.animation` in the output of `scripts/detect.mjs --config`; when
+detect cannot run, it is the `animation:` block of `reference/defaults.yaml`.
 
 Animation in a product interface is feedback, not decoration. The best UI animations go unnoticed:
 they make the interface feel fast, connected, and physical, then get out of the way. Default to

plugins/user-interface/skills/design/SKILL.md

@@ -211,8 +211,12 @@ which skill to run, the order for a whole screen, or what comes after a pass.
 
 ## Gotchas
 
-- When `node` is missing, detect cannot run: read the project's design files yourself and treat
-  `installed` as `null`.
+- With no shell or no `node`, detect cannot run: read the project's design files yourself, treat
+  `installed` as `null`, and take every setting a spoke calls resolved from
+  `${CLAUDE_PLUGIN_ROOT}/reference/defaults.yaml`.
+- Reach plugin files only by the paths this skill and `concerns.json` name, listing only the
+  directories this skill names (`${CLAUDE_PLUGIN_ROOT}/reference/types/`): a spoke already holds the technique the
+  concern needs. Never Grep or Glob the plugin's root; search the project.
 - `installed` lists only what detect can see. A plugin installed but disabled for this project does
   not count, so do not route to it; tell the user it is installed and off.
 - A `reason` beside a non-null `installed` list means detect could not resolve this plugin's own