fix(kyberforge): align primitive-author and factory-audit rule tiers

Second clean-context audit found author Must/Should and audit FAIL/SUGGESTION
tiers drifting apart, and author Musts the audit never checked.

- factory-audit: FAIL on absolute or bare relative hook script paths, an
  applyTo present but empty, and unbalanced braces/brackets in applyTo;
  judgment steps for dependency stem collisions, helper .json in hook dirs,
  unresolvable instruction links, prompt model slugs and second-person
  bodies; an unmatched glob drops to SUGGESTION; deliberate tier deviations
  recorded in hook-flow.md; validate.sh --help lists the three new modes;
  DescriptionOpener message no longer prescribes "Use when".
- primitive-author: deprecated routing, extra prompt keys and the prompt
  description contract become Shoulds; hook Musts gain "contributes an
  entry", no bare relative paths, and executable-when-run-directly;
  prompt Must 1 covers hardlinks; Vale prose FAILs resolved at close.
- forge: say "hook, instruction or prompt" rather than "apm primitive".

Refs #94

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/primitive-author/references/instruction.md

@@ -35,7 +35,8 @@ Must:
 2. `description` is a non-empty string. apm only warns when it is missing.
 3. The body is non-empty after trimming whitespace. apm deploys an empty rule silently.
 4. `applyTo` is a non-empty glob or comma-separated list — top-level commas only as separators,
-   alternation inside `{}` (`"**/*.{ts,tsx}"`) — or absent after the Gate's explicit yes.
+   alternation inside `{}` (`"**/*.{ts,tsx}"`), braces and brackets balanced — or absent after the
+   Gate's explicit yes. An empty `applyTo: ""` is neither.
 5. The stem is unique across the package and its dependencies: a `.claude/rules/<stem>.md`
    collision is silently overwritten.
 
@@ -48,5 +49,6 @@ Should:
 8. Put any rationale Claude needs in the body. `description` never reaches Claude — it survives only
    for Copilot and as Cursor's index text.
 9. Keep relative markdown links resolvable from the source file.
-10. Check the glob against the tree: one that matches nothing never fires, and one broader than the
-    rule's real scope spends context on every file it touches.
+10. Check the glob against the tree: one that matches nothing here fires only in consumer repos
+    that have such files, and one broader than the rule's real scope spends context on every file
+    it touches.