Fix code-modernization plugin: align README with commands, fix pipeline gaps

- modernize-brief: read TOPOLOGY.html (what modernize-map actually
  produces) instead of nonexistent TOPOLOGY.md, and tell the user which
  command produces each missing input.
- README: rewrite the Commands section to match actual command behavior —
  correct output filenames, ordering (brief is the synthesis/approval gate
  after discovery, not the first step), agent attributions, and required
  args. Add a workspace-layout note and an explicit callout that
  modernize-harden edits legacy/, which conflicts with the recommended
  deny rule. Reconcile the Overview and Typical Workflow sequences.
- modernize-assess: generalize the production-runtime overlay step so it
  no longer assumes a specific MCP server/tool; mark it optional. Fix
  app/jcl/ -> legacy/$1/jcl/ for layout consistency.
- modernize-map: make TOPOLOGY.html self-contained (load Mermaid from a
  CDN) so it renders in any browser; drop assumptions about an external
  artifact renderer. Generalize the telemetry annotation note.
- business-rules-extractor agent: fix command cross-reference to the
  actual command name.
- plugin.json: include the brief step in the workflow description.

plugins/code-modernization/commands/modernize-assess.md

@@ -99,20 +99,21 @@ Spawn three subagents **concurrently** using the Task tool:
 
 Wait for all three. Synthesize their findings.
 
-## Step 4 — Production runtime overlay (observability)
+## Step 4 — Production runtime overlay (optional)
 
-If the system has batch jobs (e.g. JCL members under `app/jcl/`), call the
-`observability` MCP tool `get_batch_runtimes` for each business-relevant
-job name (interest, posting, statement, reporting). Use the returned
-p50/p95/p99 and 90-day series to:
+If production telemetry is available — an observability/APM MCP server, batch
+job logs, or runtime exports the user can supply — gather p50/p95/p99
+wall-clock for the system's key jobs/transactions (e.g. JCL members under
+`legacy/$1/jcl/`, scheduled batches, top API routes). Use it to:
 
 - Tag each functional domain from Step 3 with its production wall-clock
   cost and **p99 variance** (p99/p50 ratio).
 - Flag the highest-variance domain as the highest operational risk —
   this is telemetry-grounded, not a static-analysis opinion.
 
-Include a small **Batch Runtime** table (Job · Domain · p50 · p95 · p99 ·
-p99/p50) in the assessment.
+Include a small **Runtime Profile** table (Job/Route · Domain · p50 · p95 ·
+p99 · p99/p50) in the assessment. If no telemetry is available, skip this
+step and note the gap in the assessment.
 
 ## Step 5 — Documentation gap analysis
 
@@ -126,7 +127,7 @@ Create `analysis/$1/ASSESSMENT.md` with these sections:
 - **Executive Summary** (3-4 sentences: what it is, how big, how risky, headline recommendation)
 - **System Inventory** (the scc table + tech fingerprint)
 - **Architecture-at-a-Glance** (the domain table; reference the diagram)
-- **Production Runtime Profile** (the batch-runtime table from Step 4, with the highest-variance domain called out)
+- **Production Runtime Profile** (the runtime table from Step 4 with the highest-variance domain called out — or "no telemetry available")
 - **Technical Debt** (top 10, ranked)
 - **Security Findings** (CWE table)
 - **Documentation Gaps** (top 5)