fix(kyberforge): stop union-masking drift between vale-audit-prefilter manifests

hook_file_regexes() unioned the `files:` regex from .pre-commit-hooks.yaml
and .pre-commit-config.yaml before checking whether a probe path is in
scope of a kyberforge vale-audit-prefilter hook. That union let a probe
matching only the old, looser .pre-commit-hooks.yaml pattern pass even
after .pre-commit-config.yaml's copy of the same hook had been narrowed
(e.g. to require a `.agent.md` suffix) -- silently masking exactly the
kind of hook-rescoping drift this check exists to catch. Per ADR-0014
the two manifests are meant to exercise the same resolution path an
external consumer's hook would, so this divergence is real drift, not
noise.

hook_file_regexes() now takes the manifest path explicitly and caches
per (skill, manifest) pair instead of per skill, so each manifest's
regex set can be inspected on its own. The probe-validation loop
computes in_hooks/in_config independently via a new matches_any_regex()
helper. Probes carry a new third heredoc field, `shared` or
`hooks-only`: `shared` probes (a file shape genuinely covered by both
manifests, e.g. plugins/demo/.apm/agents/demo.agent.md) must agree
between the two or the check now fails with a drift error;
`hooks-only` probes (a Copilot .agent.md living outside this repo's
own plugins/.apm/ layout, and the legacy bare-`.md`-under-agents/ shape
kept only to exercise a distinct .vale.ini glob section in isolation)
are exempt, since .pre-commit-hooks.yaml is deliberately broader there
by design. The original "matches no regex in either manifest"
staleness check is unchanged.

Added case 11b to tests/test-check-vale-style-sync.sh: narrows a
fixture's local config regex further while leaving
.pre-commit-hooks.yaml untouched, and asserts the check now flags it.
Confirmed red against the pre-fix script before applying the fix.

Refs: #95

tests/test-check-vale-style-sync.sh

@@ -258,6 +258,31 @@ else
   pass "exits non-zero when a probe path is in no hook's scope any more"
 fi
 
+# --- 11b. Exits 1 when the local config's files: regex narrows out of sync
+# with the canonical .pre-commit-hooks.yaml regex ---
+# hook_file_regexes() used to union the two manifests' `files:` regexes before
+# checking probe coverage, so a probe that matched only the old, looser
+# .pre-commit-hooks.yaml pattern still passed as "in scope" even after
+# .pre-commit-config.yaml's copy of the same hook was narrowed away from it.
+# That is exactly the shape of rescoping this repo's own agent hook went
+# through (SKILL/agent `.md` -> `.apm/.../*.agent.md`): the local hook quietly
+# stopped linting a shape the shipped, external-facing manifest still claims
+# to cover, and nothing caught it. Reproduce it directly: narrow only the
+# fixture's local config regex (leave .pre-commit-hooks.yaml as shipped) and
+# assert the check now flags the disagreement instead of passing silently.
+echo ""
+echo "--- exits 1 when .pre-commit-config.yaml's files: regex drifts out of sync with .pre-commit-hooks.yaml's ---"
+FIXTURE16B="$(make_fixture)"
+FIXTURES+=("$FIXTURE16B")
+break_glob "$FIXTURE16B/.pre-commit-config.yaml" \
+  "files: '^plugins/[^/]+/\\.apm/agents/[^/]+\\.agent\\.md\$'" \
+  "files: '^plugins/kyberforge/\\.apm/agents/[^/]+\\.agent\\.md\$'"
+if bash "$SCRIPT" "$FIXTURE16B" > /dev/null 2>&1; then
+  fail "exited 0 when the local config regex narrowed out of sync with .pre-commit-hooks.yaml — expected exit 1"
+else
+  pass "exits non-zero when the local config regex narrows out of sync with the canonical .pre-commit-hooks.yaml regex"
+fi
+
 # --- 12. The text-level assertions hold on a machine without vale ---
 # They are the fallback when the glob probe cannot run. With vale on PATH the
 # probe fails on these same mutations, so it would mask them: only masking vale