feat(kyberforge): add primitive-author for apm hooks, instructions and prompts

New skill that creates or improves an apm hook, instruction or prompt.
Its SKILL.md holds the shared procedure (dispatch on primitive, boundary
gate, create-or-improve, factory-audit close); one self-contained
reference per primitive carries its gate, checklist and template, drawn
from the microsoft-apm research docs and ADR-0029.

forge gains a route row sending a hook, instruction or prompt to
primitive-author through author-routes.md, and no longer lists hooks as
unroutable. factory-audit's description adds the primitive-author
boundary now that the target resolves.

Fixes #94

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/primitive-author/references/instruction.md

@@ -0,0 +1,51 @@
+---
+source_keys:
+  - apm-cli-installed-source
+  - apm-docs-llms-full
+---
+
+# Authoring an apm instruction
+
+Reached from `SKILL.md` Step 1 for an instruction. Run the Gate, then write against the checklist,
+then return to `SKILL.md` Step 3.
+
+## Gate
+
+An instruction is a scoped rule: it applies when the agent touches files matching its `applyTo`
+glob. On Claude it deploys to `.claude/rules/<stem>.md` with `applyTo` renamed to `paths:`.
+
+- **A rule for this repo alone** → it belongs in the repo's AGENTS.md, which is the single
+  always-on source. Stop and hand to `agentsmd-author`.
+- **No file pattern fits** → an instruction without `applyTo` is always-on in every session of
+  every repo that installs this package, and `apm compile` folds it into the global sections of
+  `AGENTS.md` and `CLAUDE.md`. Say exactly that to the user and continue only on an explicit yes.
+  Legitimate when a package deliberately ships guidance to its consumers; never a default.
+- **Procedure the agent follows step by step** → a skill. Stop and hand to `skill-author`.
+- **A rule scoped to a file pattern** → continue.
+
+## Checklist
+
+Copy `assets/templates/name.instructions.md.template` and drop `.template` only on the final path.
+
+Must:
+
+1. The path is `.apm/instructions/<stem>.instructions.md`, directly in that directory, not a
+   symlink or hardlink.
+2. `description` is a non-empty string. apm only warns when it is missing.
+3. The body is non-empty. apm deploys an empty rule silently.
+4. `applyTo` is a non-empty glob or comma-separated list — top-level commas only as separators,
+   alternation inside `{}` (`"**/*.{ts,tsx}"`) — or absent after the Gate's explicit yes.
+5. The stem is unique across the package and its dependencies: a `.claude/rules/<stem>.md`
+   collision is silently overwritten.
+
+Should:
+
+6. Write `applyTo` as a scalar string, not a YAML list. Copilot receives the source verbatim, and
+   its handling of a list is unverified.
+7. Keep frontmatter to `description` and `applyTo`, plus optional `author` and `version`. No target
+   consumes other keys, and Claude drops them.
+8. Put any rationale Claude needs in the body. `description` never reaches Claude — it survives only
+   for Copilot and as Cursor's index text.
+9. Keep relative markdown links resolvable from the source file.
+10. Check the glob against the tree: one that matches nothing never fires, and one broader than the
+    rule's real scope spends context on every file it touches.