fix(gates): hold skill versions above main's tip as well as the merge-base

Why: two branches that both bump a skill 1.0.0 -> 1.0.1 with different
content merge without a conflict, and each passed the gate against its own
merge-base, so main could ship two changes under one version.

Implementation Notes:
- check-skill-version-bump requires the pushed version to exceed both the
  merge-base and the main tip; failures name the baseline they missed.
- Presence is read from the tree, so a blob missing from a partial clone is
  a read failure instead of a silently exempt "new" skill.
- A leading UTF-8 BOM no longer reads as a missing version.
- Version parts reject leading zeros in all three validators
  (check-skill-version-bump, skill-size-check, factory-audit).
- New tests cover equal bumps, moved files, major/minor ordering, bad refs,
  unreadable blobs, mode-only changes, symlinks and tag peeling.

Impact: ADR-0022 amended (reverses "not main's current tip"); gates.md
updated to match, including pre-commit 4.6.1's exact ref selection.

ADR: 0022
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kyberforge/.apm/skills/factory-audit/tests/validate-skill.bats

@@ -377,7 +377,7 @@ SH
 
 # ---------------------------------------------------------------------------
 # ADR-0022 — metadata.version is mandatory. FAIL tier, matching the
-# skill-frontmatter pre-commit hook: an audit that graded this lower would
+# skill-size-check pre-commit hook: an audit that graded this lower would
 # report ready-to-ship on a file the commit gate rejects.
 # ---------------------------------------------------------------------------
 
@@ -437,6 +437,62 @@ PY
     assert_output --partial "metadata.version present: '0.1.3'"
 }
 
+@test "ADR-0022: a leading zero in the patch part FAILs (1.0.08)" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  version: "1.0.08"\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+    assert_output --partial "three-part semver"
+}
+
+@test "ADR-0022: a leading zero in the major part FAILs (01.0.1)" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  version: "01.0.1"\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+    assert_output --partial "three-part semver"
+}
+
+@test "ADR-0022: a multi-digit part with no leading zero passes (1.0.10)" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  version: "1.0.10"\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "metadata.version present: '1.0.10'"
+}
+
+@test "ADR-0022: a zero major part passes (0.1.0)" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  version: "0.1.0"\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "metadata.version present: '0.1.0'"
+}
+
 @test "fails when name contains consecutive hyphens" {
     local skill="$TMPDIR/my--skill"
     make_valid_skill "$skill"