feat(kyberforge): add agent-audit provenance chain validation (closes #60)

## Why

agent-author produces agents/sources.md at plugin scope to record which
research sources informed which agent files. agent-audit had no way to
validate this chain, leaving stale or missing provenance undetected.

## Implementation Notes

Validation is per-pair (the given agent file + its counterpart) rather
than plugin-wide, keeping the scope consistent with validate.sh. The
script exits 0 silently for non-plugin-scope agents.

source_keys is top-level in both CC .md and Copilot .agent.md files
(not under metadata:) to avoid conflict with Copilot's own metadata
field semantics. Checks 0, 1, 2, 4, 5, 6 mirror the skill provenance
set; upstream research-doc cross-reference checks (7, 8) are deferred.

agent-author Steps 2, 3, and 4 updated to formally specify the
agents/sources.md format and instruct authors to add source_keys to
both files when research sources are in context.

Refs: #60

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147vXtL5sP6vorDdqXGJJU9

plugins/kyberforge/skills/agent-author/SKILL.md

@@ -102,6 +102,13 @@ Open the scaffolded Claude Code file. Replace every `FILL IN:` placeholder.
 - `memory`: `user`, `project`, or `local` — only when cross-session state is genuinely needed
 - `isolation: worktree` — only when the agent modifies files and needs an isolated copy
 
+**`source_keys`** — top-level list of research source slugs that informed this agent. Add only when research sources were used (i.e. entries with `` `extracted` `` status are in context from a prior `/research` session). Each slug must match an H2 heading in `agents/sources.md`. Omit entirely when no research was used.
+
+```yaml
+source_keys:
+  - my-source-slug
+```
+
 **System prompt body** — write as a direct role instruction:
 - Open with: "You are a [role]. When invoked, [primary action]."
 - Cover: inputs expected, process steps, output format, error handling
@@ -119,6 +126,8 @@ Open the scaffolded Copilot file. Replace every `FILL IN:` placeholder.
 
 **Do not include Claude Code-only fields**: `maxTurns`, `isolation`, `memory`, `permissionMode`, `effort`, `hooks`, `mcpServers`.
 
+**`source_keys`** — add the same top-level list as the CC file when research sources were used. Omit when no research was used.
+
 The system prompt body should match the Claude Code version — the agent's task definition is the same across providers.
 
 ### Step 4 — Populate or delete `agents/sources.md` (plugin scope only)
@@ -127,8 +136,22 @@ Skip this step at project and user scope.
 
 If a research `sources.md` is present in the conversation context:
 1. Filter to entries with `` `extracted` `` status only.
-2. For each entry, note which agent files it contributed to.
-3. Write `agents/sources.md` with those entries. Include `- **Research doc:** <path>` per entry pointing to the upstream research sources file.
+2. For each entry, identify which agent files in the pair it contributed to.
+3. Write `agents/sources.md` using the format below. Paths in `Contributing files:` are relative to the plugin root.
+
+```markdown
+# Sources
+
+## slug-name
+
+- **URL:** <source URL>
+- **Research doc:** <path/to/research/sources.md relative to repo root>
+- **Description:** <what this source covers>
+- **Contributing files:** agents/<name>.md, agents/<name>.agent.md
+- **Status:** `extracted`
+```
+
+Each slug must match an H2 heading, and each slug must also appear in the `source_keys` list of every file listed under `Contributing files:`.
 
 If no research sources are in context, delete `agents/sources.md`.
 

plugins/kyberforge/skills/agent-author/assets/templates/claude-code.md

@@ -45,6 +45,11 @@ description: FILL IN: Action-first description of what this agent does and when
 # background: false
 # Optional. Set true to force background execution.
 
+# source_keys:
+#   - slug-name
+# Development-only. Add when research sources informed this agent (slugs must match agents/sources.md).
+# Omit when no research was used. Not a runtime field — silently ignored by Claude Code.
+
 # NOTE: hooks, mcpServers, and permissionMode are silently ignored for plugin agents.
 # Those fields only work in .claude/agents/ or ~/.claude/agents/.
 ---

plugins/kyberforge/skills/agent-author/assets/templates/copilot.agent.md

@@ -37,6 +37,11 @@ description: FILL IN: Action-first description of what this agent does and when
 # model: claude-sonnet-4-5
 # Optional. Model to run this agent on.
 
+# source_keys:
+#   - slug-name
+# Development-only. Add when research sources informed this agent (slugs must match agents/sources.md).
+# Omit when no research was used. Not a Copilot runtime field — silently ignored.
+
 # DO NOT include these Claude Code-only fields:
 #   maxTurns, isolation, memory, permissionMode, effort, hooks, mcpServers
 ---