fix(kyberforge): route primitive authoring from apm-workflow and agent-author

- reach the MCP ${VAR} secrets rule from the compile flow
- restore the Gotcha remedy for type: coverage
- route .apm/instructions and .apm/prompts to primitive-author
- agent-author: add the primitive-author boundary and the already-bumped
  skip, bump to 1.0.4

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/agent-author/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: agent-author
 description: >
-  Use when the user wants to create a new agent definition file from scratch, or
-  apply grill findings, audit findings, or inline feedback to an existing one.
+  Use when the user wants a new agent definition created, or grill, audit
+  or inline feedback applied to an existing one.
   Not read-only review -> `factory-audit`. Not skills -> `skill-author`.
+  Not hooks, instructions or prompts -> `primitive-author`.
 allowed-tools: Bash Read Write Edit
 metadata:
-  version: "1.0.3"
+  version: "1.0.4"
   category: factory
   source_keys:
     - context7-websites-code-claude
@@ -60,6 +61,6 @@ At every scope, five tools reach no subagent whatever `tools` says — `AskUserQ
 
 Invoke `factory-audit` on each file written and resolve every FAIL before reporting done. It checks the field allowlist, name-to-stem match, leftover placeholders and template comments, the description budget and the Copilot body limit — do not hand-check those.
 
-At plugin/APM scope bump the resolved package's `apm.yml` `version` — **minor** on create, **patch** on improve — because consumers compare it to detect updates. Project and user scope have no manifest.
+At plugin/APM scope bump the resolved package's `apm.yml` `version` — **minor** on create, **patch** on improve — because consumers compare it to detect updates. Skip, and say so, if this branch already bumped it: `git diff $(git merge-base HEAD <remote-default-branch>) -- <package>/apm.yml` shows a changed `version:` line, and one bump covers a branch. Project and user scope have no manifest.
 
 **Commit verification.** Once the audit is clean, run `rtk git add` and `rtk git commit` — do not stop at staging. Re-run `rtk git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is lost if the tree is cleaned up. Report done only once the hash has changed.