chore(plugins): sync generated content mirrors

Regenerates `plugins/*/skills`, `plugins/*/agents`, both per-plugin `plugin.json` manifests and the
two marketplace mirrors from `.apm/` per ADR-0017, via `scripts/sync-plugin-content.sh --all`.

The manifests matter beyond tidiness here: `plugin.json` carries the plugin version and wins over
the marketplace entry at install time (calculatePluginVersion precedence). Until this ran, the patch
bumps in the preceding commit were inert for anyone installing these plugins.

ADR: 0017
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

plugins/kyberforge/skills/skill-audit/references/validation-scripts.md

@@ -6,8 +6,9 @@ source_keys:
 
 # Validation Scripts Reference
 
-Read this when a Step 1 script fails, cannot run, or reports something that needs interpreting.
-Nothing here is needed on a clean run.
+Read this when a Step 1 script fails, cannot run, or reports something that needs interpreting —
+including `validate-provenance.sh` exiting **0 having printed something**, which is INFO findings,
+not a clean run. Its silent exit 0 is the only outcome that needs nothing here.
 
 ## Report the gap, do not guess
 
@@ -106,18 +107,33 @@ Three ways to read the result wrong:
   `python3` all exit **2** with a message on stderr. Exit 2 means the script never ran — report it
   as an unaudited dimension, never as a pass and never as a finding. Exit 1 is findings.
 - **A check-9 INFO — `'<field>' changed for '<slug>' since <ref>` — means go read, not just relay.**
-  Check 9 diffs the current `references/sources.md` against a base ref (default: the merge base with
-  `origin/main`) and flags a slug whose `Description` or `Contributing files` text differs. It is
-  structurally incapable of telling you whether the new wording is still *true* — it only detects
-  that the text changed — so when this INFO fires, open the Contributing files it names and the
-  document named in that slug's `Research doc:` field, and confirm by reading whether the (possibly
+  Check 9 diffs the current `references/sources.md` against a base ref and flags a slug whose
+  `Description` or `Contributing files` text differs. It is structurally incapable of telling you
+  whether the new wording is still *true* — it only detects that the text changed — so when this
+  INFO fires, open that slug's own entry: the document named in its `Research doc:` field, and the
+  files its `Contributing files` list names. Read whichever the changed field is a claim *about* —
+  a Description-only change often leaves the file list untouched, so "open the Contributing files"
+  is where to look, not proof that they are what moved. Confirm by reading whether the (possibly
   strengthened) claim genuinely holds. This is the one provenance finding this script cannot verify
   for you: every other check here is a structural fact you can relay as-is, but check 9's job is
   only to tell you *where* to spend that reading effort, not to replace it. Acknowledging the INFO
-  without opening those files is not auditing it. A single INFO naming "no base ref could be
-  resolved" or "no repo root above the skill directory" is the same graceful-skip pattern as every
-  other check here that cannot run — treat it as an unaudited dimension for that reason, not as a
-  finding about the skill.
+  without opening those files is not auditing it. Its companion — `'<field>' removed for '<slug>'
+  since <ref>` — is the same obligation in the other direction: a claim withdrawn rather than
+  rewritten. No other check here requires the field, so confirm the removal was deliberate.
+- **The check-9 base ref defaults to `git merge-base HEAD origin/main`, and there are two ways to
+  override it.** `--base-ref=<ref>` on the command line, or the `VALIDATE_PROVENANCE_BASE_REF`
+  environment variable; the flag wins when both are given, including when it is given empty
+  (`--base-ref=`), which selects the default resolution and ignores the environment. Reach for one
+  on a fork, a long-lived branch, or a mirror whose remote is not called `origin` — and when a
+  review asks what changed since a specific commit rather than since the branch point.
+- **A single check-9 INFO naming a whole-check skip is an unaudited dimension, not a finding about
+  the skill.** There are three: "no repo root above the skill directory", "no base ref could be
+  resolved", and "`<path>` is not tracked at `<ref>`". The third is the one to read carefully — it
+  fires when the base ref resolved but `git show <ref>:<path>` did not, which covers both a
+  genuinely new `sources.md` (nothing to flag) and a path git does not know under that name: a
+  renamed skill directory, or an installed, gitignored copy such as a deployed `.claude/skills/`
+  tree. Auditing the deployed copy silently checks nothing; re-run against the authoring path under
+  `plugins/*/.apm/skills/`.
 - **`vale` reports `0 files`.** Treat the pass as NOT RUN, not as clean, and fall back to full
   Step 3 judgment for the dimensions it would have covered. The bundled `Kyberforge` style is
   scoped by glob in `assets/vale/.vale.ini`; a file outside those globs is silently not linted.