fix(kyberforge): route primitive authoring from apm-workflow and agent-author

- reach the MCP ${VAR} secrets rule from the compile flow
- restore the Gotcha remedy for type: coverage
- route .apm/instructions and .apm/prompts to primitive-author
- agent-author: add the primitive-author boundary and the already-bumped
  skip, bump to 1.0.4

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/apm-workflow/references/compile.md

@@ -34,6 +34,8 @@ Bundles a producer package into a distributable artifact. Default to `--dry-run
 - A populated one gets its `mcpServers` content merged directly into the compiled `plugin.json`, but only for the `claude` target.
 - The `copilot` target's compiled `plugin.json` OMITS `mcpServers` entirely — it isn't part of Copilot's plugin manifest schema.
 
+`mcpServers` headers and env must use `${VAR}` indirection — the content is merged verbatim into the published `plugin.json`, so a literal secret ships with the package.
+
 `dependencies.mcp` in `apm.yml` is for a different purpose — declaring a remote MCP-server package as an APM dependency — not local `.mcp.json` passthrough.
 
 ### `includes: auto` and the packed bundle