fix(kyberforge): fix HOME/git scope-walkup false-FAILs in agent-audit

validate.sh's detect_scope() and validate-provenance.sh's
find_plugin_root() disagreed with new-agent.sh's already-correct,
documented walk-up semantics on three points, each causing validate.sh
to false-FAIL a legitimately-scaffolded project-scope agent pair:

- a marker-less directory walked up into $HOME (no .git/apm.yml of its
  own) was classified as user scope instead of project scope
- the .git-boundary branch returned the walked-to .git location instead
  of the conventional scope root, breaking any <root> that is a
  subdirectory of a larger git-tracked tree (monorepo package dirs)
- the new conventional-root arithmetic introduced to fix the above two
  cases had no guard against non-conventional/hand-placed file paths,
  which could point it at the wrong ancestor

Also adds scripts/check-scope-walkup-sync.sh, a behavioral drift-guard
(per ADR-0014's no-cross-skill-path precedent) that cross-checks the
four independently hand-ported walk-up implementations (validate.sh,
validate-provenance.sh, new-agent.sh, new-skill.sh) against real
fixture scaffolds, wired into .pre-commit-config.yaml at pre-push so
future drift between the ports is caught automatically.

Verified via bash tests/run-tests.sh (13/13) and targeted before/after
reproduction of each bug this closes.

plugins/kyberforge/skills/agent-audit/tests/validate-provenance.bats

@@ -183,6 +183,36 @@ EOF
     assert_output --partial "FAIL"
 }
 
+@test "non-plugin scope: \$HOME boundary stops the walk before reaching an ancestor apm.yml above \$HOME" {
+    # A type-bearing apm.yml sits ABOVE the fake $HOME — if find_plugin_root
+    # didn't stop at $HOME, it would walk past it and misclassify this
+    # user/project-scope file as plugin scope, which would then FAIL on
+    # Check 0 (source_keys declared but sources.md absent) since sources.md
+    # doesn't exist at that ancestor apm.yml's location either.
+    local dir="$TMPDIR/anc"
+    mkdir -p "$dir"
+    cat > "$dir/apm.yml" <<EOF
+name: outer-package
+version: 0.1.0
+type: skill
+EOF
+    local fake_home="$dir/fakehome"
+    mkdir -p "$fake_home/.apm/agents"
+    cat > "$fake_home/.apm/agents/my-agent.agent.md" <<EOF
+---
+name: my-agent
+description: A valid agent description.
+source_keys:
+  - my-source
+---
+
+You are a test agent.
+EOF
+    run env HOME="$fake_home" bash "$SCRIPT" "$fake_home/.apm/agents/my-agent.agent.md"
+    assert_success
+    assert_output ""
+}
+
 @test "non-plugin scope: .git between the agent file and an ancestor apm.yml stops the walk first" {
     local dir="$TMPDIR/repo2"
     mkdir -p "$dir/.apm/agents"