docs: correct the apm-only change after a five-agent review

A five-agent review of 718c79a and d2480b8 found no skill, agent or hook
regressions (39 skills before and after) and confirmed both hook removals
are genuinely moot -- verified against the tree, not taken on the commit's
word. It did find one functional regression (fixed separately) and this
documentation drift.

Counting errors, all from a git pathspec `*` crossing `/`:
  - 17 .bats files shipped to consumers is really 10; 17 counted tracked
    paths merely containing /tests/, one of them a template asset
  - "roughly 88s off every push" is ~92.4s; 88 omitted validate-plugins
  - "roughly 70% of each plugin remains live" holds only for kyberforge;
    the real spread is 44.3% (bin) to 70.6%, now a table
  - the pre-push enforcement row was half-corrected: 33 entries stood
    unstruck (now 27) and 14 -> 11 switched counting basis mid-sentence
  - the root .claude-plugin/plugin.json was described as "kept"; it has
    never been tracked

gates.md said "Ten hooks" above a nine-row table (11 was decremented for
one removal, not two), and "both need the claude CLI" for one remaining
validator. Its pretty-format-json exclude rationale claimed six
alternations expanding to sixteen files in a passage headed "Mind which
number you are quoting" -- four alternations, two live files; the two
dead ones are dropped from the pattern. check-useless-excludes could not
catch this: it only flags an exclude matching nothing at all.

ADR-0024 cited ADR-0006 for a patch-bump rule it does not contain and
which ADR-0015 explicitly retired; stated apm's marketplace probe order
backwards (.claude-plugin/ is the last candidate, not the first, so the
earlier .github/plugin/ deletion only demoted resolution); undercounted
apm's skill-deploying targets as seven when there are fifteen; and never
recorded that validate-plugins was removed. The symlink hedge is resolved:
apm_cli/security/gate.py's ignore_non_content() drops symlinks silently on
deploy while apm_modules/ materialization dereferences them, so content
survives that far and vanishes at install. Accepted with no replacement
guard, per decision -- kyberforge/docs/hooks.md previously asserted a
guard that had been deleted with its script.

Four plugin READMEs still advertised `claude plugin install`; ADRs 0001,
0006, 0013, 0014, 0015 and 0019 described deleted machinery in the present
tense, 0019 most consequentially as the live justification for the
SessionStart hook's .apm/ path. CONTEXT.md's "apm package" entry forbade
"plugin" while using it in its own body, and "Output profile" lost the
antecedent for "one catalogue serves both".

run-tests.sh gains the .claude/skills/ exclusion run-bats.sh already had.
Latent today -- no test-*.sh lives under any .apm/skills/*/tests/ -- but
apm now deploys those directories, so one would be discovered twice.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD

docs/spec/gates.md

@@ -38,7 +38,7 @@ a PR merged through Gitea's merge button, where no local push happens at all.
 
 ## The pre-push gate
 
-Ten hooks, grouped below by what they guard rather than by the order `.pre-commit-config.yaml` declares them in.
+Nine hooks, grouped below by what they guard rather than by the order `.pre-commit-config.yaml` declares them in.
 
 **Core checks**
 
@@ -70,7 +70,7 @@ drift in generated text.
 | `apm-audit-ci` | `apm audit --ci` once per manifest — root plus each of the six plugin packages |
 | `apm-pack-check-clean` | `apm pack --check-versions --check-clean --dry-run` — the compiled marketplace still matches what `apm.yml` + `.apm/` would generate, and per-package versions agree with the `per_package` strategy |
 
-**Host validators** (both need the `claude` CLI on PATH)
+**Host validators** (needs the `claude` CLI on PATH)
 
 | Hook | Guards |
 |---|---|
@@ -116,9 +116,9 @@ git ls-files | grep -E '^plugins/[^/]+/\.apm/skills/.*SKILL\.md$' \
 ```
 
 The first count equals the number of skill directories (`ls -d plugins/*/.apm/skills/*/ | wc -l`);
-the second returns exactly the template. The remaining unmatched `SKILL.md` files in the tree are the
-generated flat mirror, which is excluded by the `.apm/` segment on purpose — a mirror edit is drift,
-not an authoring change.
+the second returns exactly the template. Every other tracked `SKILL.md` in the tree is one of the
+four vendored `plugins/kyberforge/docs/research/examples/skill-write/` corpus files, excluded by the
+`.apm/skills/` segment — the first of the two deliberate exclusions above.
 
 ### Two independent gate families, neither replaced the other
 
@@ -613,9 +613,11 @@ Two prefilter hooks, with `.apm/`-scoped `files:` patterns:
 | `vale-audit-prefilter-skill` | `^plugins/[^/]+/\.apm/skills/[^/]+/SKILL\.md$` |
 | `vale-audit-prefilter-agent` | `^plugins/[^/]+/\.apm/agents/[^/]+\.agent\.md$` |
 
-Only the **authoring source** triggers them. A `SKILL.md` in the generated flat mirror matches
-neither pattern, so prose findings surface only when you edit the file you are supposed to be
-editing. Without the binary the hooks fail with a bare "command not found" and no install pointer.
+Only the **authoring source** triggers them. The `skill-author` scaffold template and the four
+vendored research-corpus `SKILL.md` files match neither pattern (see
+[Skill and agent context gates](#skill-and-agent-context-gates-adr-0020), which uses the same scope
+for `skill-size-check`), so prose findings surface only when you edit a file this repo actually
+authors. Without the binary the hooks fail with a bare "command not found" and no install pointer.
 
 **Two hooks, not one combined hook.** Both manifests split the prefilter in two precisely because a
 single hook can point at only one copy, and that copy would silently 0-file-skip the other file
@@ -864,10 +866,9 @@ does not deploy and the replay does not compare; shared enforcement belongs in
 
 ### Why it is excluded from `pretty-format-json`
 
-It is the **sixth and last alternation** in that hook's `exclude:` pattern, and the only one there
-for a reason other than "generated manifest". Mind which number you are quoting: **six alternations,
-expanding to sixteen real files** — 3 root marketplace manifests, 2 per plugin × 6 plugins, plus this
-one.
+It is the **second and last alternation** in that hook's `exclude:` pattern, and the only one there
+for a reason other than "generated manifest". Mind which number you are quoting: **two alternations,
+expanding to two real files** — `.claude-plugin/marketplace.json`, plus this one.
 
 `pretty-format-json --autofix` sorts object keys unless `--no-sort-keys` is passed, while apm's hook
 integrator emits insertion order (`matcher` before `hooks`, `type` before `command`). Leaving the
@@ -895,10 +896,13 @@ this remote before any network call.
   enforcement table (deterministic vs. auditor judgment), and every rejected alternative
 - `docs/adr/0019-session-start-hook-keeps-the-apm-install-current.md` — the `SessionStart` hook, the
   executable-trust gate, and the version-pinned allow key
-- `docs/adr/0017-plugin-content-mirror-bridges-apm-to-host-discovery.md`,
-  `docs/adr/0015-apm-replaces-plugin-marketplace-authoring.md`,
-  `docs/adr/0014-vale-prefilter-ships-from-the-plugin.md` — plugin content sync, apm-generated
-  manifests, committed Vale styles
+- `docs/adr/0024-apm-is-the-only-supported-install-path.md` — apm as the sole install path, and the
+  deletion of the flat content mirror and its `check-plugin-content-sync` gate. It supersedes
+  `docs/adr/0017-plugin-content-mirror-bridges-apm-to-host-discovery.md` (**superseded** — plugin
+  content sync, kept as the historical record)
+- `docs/adr/0015-apm-replaces-plugin-marketplace-authoring.md`,
+  `docs/adr/0014-vale-prefilter-ships-from-the-plugin.md` — apm-generated manifests, committed Vale
+  styles
 - `docs/spec/architecture.md` — directory structure, install pipeline, what is generated and what is
   hand-authored
 - `.pre-commit-config.yaml` — the hooks themselves, with inline rationale comments