fix(kyberforge): fix HOME/git scope-walkup false-FAILs in agent-audit

validate.sh's detect_scope() and validate-provenance.sh's
find_plugin_root() disagreed with new-agent.sh's already-correct,
documented walk-up semantics on three points, each causing validate.sh
to false-FAIL a legitimately-scaffolded project-scope agent pair:

- a marker-less directory walked up into $HOME (no .git/apm.yml of its
  own) was classified as user scope instead of project scope
- the .git-boundary branch returned the walked-to .git location instead
  of the conventional scope root, breaking any <root> that is a
  subdirectory of a larger git-tracked tree (monorepo package dirs)
- the new conventional-root arithmetic introduced to fix the above two
  cases had no guard against non-conventional/hand-placed file paths,
  which could point it at the wrong ancestor

Also adds scripts/check-scope-walkup-sync.sh, a behavioral drift-guard
(per ADR-0014's no-cross-skill-path precedent) that cross-checks the
four independently hand-ported walk-up implementations (validate.sh,
validate-provenance.sh, new-agent.sh, new-skill.sh) against real
fixture scaffolds, wired into .pre-commit-config.yaml at pre-push so
future drift between the ports is caught automatically.

Verified via bash tests/run-tests.sh (13/13) and targeted before/after
reproduction of each bug this closes.

plugins/kyberforge/skills/agent-audit/scripts/validate-provenance.sh

@@ -64,9 +64,11 @@ TYPE_RE = re.compile(r"^type:\s*(['\"]?)(instructions|skill|hybrid|prompts)\1(?:
 # --- Find package root: walk up for the nearest ancestor apm.yml that
 # declares a top-level type: field. An apm.yml with no type: field is a
 # marketplace-only manifest (see monorepo-and-repo-shapes.md) — skip it and
-# keep walking. Stop at a .git boundary or the filesystem root: neither is
-# plugin/APM scope, so this script has nothing to check there.
+# keep walking. Stop at a $HOME boundary, a .git boundary, or the filesystem
+# root: none of these is plugin/APM scope, so this script has nothing to
+# check there.
 def find_plugin_root(start_dir):
+    home = os.path.expanduser('~')
     current = os.path.abspath(start_dir)
     while True:
         apm_yml = os.path.join(current, 'apm.yml')
@@ -74,6 +76,15 @@ def find_plugin_root(start_dir):
             with open(apm_yml) as f:
                 if any(TYPE_RE.match(line) for line in f):
                     return current
+        # $HOME is a non-plugin-scope boundary — checked before the .git test
+        # below (mirrors validate.sh's detect_scope ordering), so a
+        # dotfiles-managed $HOME (yadm, chezmoi bare-repo, etc.) can't shadow
+        # this check by being its own .git repo. Without this, the walk could
+        # continue past $HOME toward the filesystem root looking for a
+        # type-bearing apm.yml, misclassifying a user/project-scope file as
+        # plugin scope in rare ancestor layouts.
+        if current == home:
+            return None
         # .git is a directory in a normal checkout but a file (`gitdir: ...`)
         # in a git worktree — exists() covers both.
         if os.path.exists(os.path.join(current, '.git')):