fix(kyberforge): bridge apm content to Claude Code's flat plugin discovery

Claude Code's (and Copilot's) native plugin installer has zero awareness of
.apm/ nesting -- it convention-scans only flat skills/, agents/, commands/,
hooks.json at each plugin's root. Confirmed via strings on the installed
claude binary and live installs of git@holocron/gitea@holocron/kyberforge@
holocron, all reporting Skills(0) Agents(0) Hooks(0) post ADR-0015's apm
conversion. Root cause (apm_cli/core/plugin_manifest.py): apm's plugin.json
compiler deliberately strips skills/agents/commands keys, assuming the host
already auto-discovers those convention directories -- it has no model of
.apm/ being host-visible at all. Separately, apm's own bundle exporter
(apm_cli/bundle/plugin_exporter.py, behind `apm pack --format plugin`)
implements the correct .apm/ -> flat mapping, but only ever targeted
build/<name>-<version>/, a path nothing in marketplace.json's source: points
at.

scripts/sync-plugin-content.sh wraps that bundle exporter and copies its
agents/, skills/, commands/, instructions/, extensions/, and merged
hooks.json back into each plugin's own root as a second tracked
compiled-output category -- same governance status as
.claude-plugin/plugin.json: generated from .apm/, never hand-edited. tests/
subdirectories are excluded from the mirror (dev fixtures, not host-visible
runtime content; several hardcode a relative repo-root walk-up sized for the
.apm/-nested depth, which breaks when duplicated one level shallower).
Applied for real across all 6 plugins and verified two ways: `claude plugin
validate --strict` passes on every real plugin directory, and a live
`claude --plugin-dir <path> -p "list skills/agents"` behavioral test
confirms content is now actually discovered.

Also, from the same issue #90 review round:
- scripts/check-manifests.sh pointed at each plugin's root-level plugin.json
  (checking skills/hooks/mcpServers/agents pointer fields) -- that file was a
  stale near-duplicate of .claude-plugin/plugin.json nothing else read or
  wrote, now deleted across all 6 plugins. check-manifests.sh is rewritten to
  validate .claude-plugin/plugin.json instead, and drops the pointer-field
  checks entirely (nothing to check -- those fields are correctly absent by
  design). Content-presence drift is now check-plugin-content-sync's job, a
  new pre-push hook wired in .pre-commit-config.yaml.

docs/adr/0017 records the root cause and decision in full, including two
rejected alternatives (patching plugin.json's path fields directly -- apm's
compiler strips them on every run; pointing marketplace.json at apm pack's
build/ output -- a version-suffixed non-source directory nothing can install
from without an extra build step). ADR-0015 and CONTEXT.md are updated to
point at it.

Refs: #90

plugins/gitea/skills/gitea-issues/references/enrichments.md

@@ -0,0 +1,92 @@
+---
+topic: enrichments
+source_keys:
+  - gitea-mcp-repo
+  - gitea-mcp-slim-go
+  - context7-websites-gitea
+---
+
+# Create-flow enrichments
+
+Closes out the four enrichments deferred from issue #6 comment #848. Run in this order before the
+`issue_write method: "create"` call in SKILL.md's create dispatch: **labels → milestone →
+assignee → dependency link**. Each step is independent and skippable on its own — a missing
+milestone fit doesn't block label inference, and so on — but this is the order that lets later
+steps use context established earlier (e.g. the inferred `Kind/*` label can inform which milestone
+plausibly fits).
+
+**Cross-skill composition note:** none of the steps below read `gitea-labels-milestones`'s
+reference files directly by path. A plugin install copies each skill's directory into an isolated
+cache — any file path that leaves this skill's own directory breaks post-install. Instead, compose
+`gitea-labels-milestones` as a skill: describe the task to it (its own `SKILL.md` and description
+trigger it) and consume the resolved IDs it returns. This mirrors how `gitea-labels-milestones`'s
+own description already frames the relationship ("`gitea-issues` and `gitea-prs` both compose it").
+
+## 1. Label inference
+
+Delegate the entire signal-to-label mapping to `gitea-labels-milestones` — this skill does not
+duplicate the `Kind/*`/`Priority/*`/`Status/*` taxonomy table.
+
+1. Compose `gitea-labels-milestones` to resolve labels for the issue being created: give it the
+   draft title/body and ask it to infer and resolve applicable labels (it calls
+   `label_read method: "list_repo_labels"` internally and runs its own inference procedure).
+2. Take back the resolved label IDs (and which scope groups, if any, need replacing — not relevant
+   yet on a brand-new issue, since there's nothing to replace).
+3. If `gitea-labels-milestones` reports low confidence and omits a `Kind/*` label, pass no `Kind/*`
+   ID rather than guessing one yourself. `Priority/Medium` is the one label its own inference
+   procedure defaults to when no urgency signal is present — that's expected, not a gap.
+4. Pass the resulting label IDs to `issue_write`'s `labels` parameter (omit the parameter entirely
+   if the resolved list is empty).
+
+## 2. Milestone assignment on create
+
+1. Compose `gitea-labels-milestones` to list open milestones (it calls
+   `milestone_read method: "list" state: "open"` internally).
+2. Compare the issue's inferred scope (title, body, and any `Kind/*` label from step 1) against
+   each open milestone's title/description. Assign a milestone only when the fit is clear — a
+   milestone literally named for the feature area, or one whose description explicitly covers this
+   kind of work. A milestone that's merely "the current one" without a clear scope match is not a
+   confident fit.
+3. If a milestone clearly fits, pass its **numeric ID** (never the title) as `issue_write`'s
+   `milestone` parameter. `issue_write`'s `milestone` field only accepts the ID — see
+   `references/issues.md`.
+4. If no milestone clearly fits, omit `milestone` entirely. Guessing a milestone assignment is worse
+   than leaving it unset — an issue can always be milestoned later, but a wrong milestone
+   assignment pollutes that milestone's issue count and scope.
+
+## 3. Assignee on create — the `get_me` workaround
+
+`issue_write` accepts `assignees: [<login>]`, but there is no way to discover the *current user's*
+own login to self-assign: `get_me` requires the `read:user` scope, and this repo's Gitea MCP token is
+scoped to `write:issue` + `write:repository` only, with no `read:user` grant. This is a hard
+capability gap, not something to work around with a guess.
+
+**Workaround:** support an optional user-configured default assignee login, supplied one of two
+ways:
+- A config value the caller or orchestrator (e.g. `gitea-workflow`) already resolved and passes in
+  when invoking this skill.
+- A login explicitly stated in the conversation ("assign this to alice") — use that login directly,
+  no lookup needed, since Gitea accepts a login string without requiring you to resolve an ID first.
+
+**If neither is available, omit `assignees` entirely.** Do not guess a login, do not fail the create
+over a missing assignee, and do not attempt `get_me`/`search_users` as a fallback — both are blocked
+by the same scope gap and will only produce a confusing secondary error.
+
+## 4. Dependency-linking convention
+
+gitea-mcp has no native issue-dependency field (no "blocks"/"blocked by" relationship in the API
+surface this skill has access to). The convention is to write **"Depends on #N"** as a line in the
+issue body.
+
+This is not just a text convention with no effect — Gitea auto-renders `#N` (and `!N` for PRs) as a
+real clickable cross-reference with no separate API call, a documented platform behavior (see
+`references/sources.md` for the backing research). This works because issues and PRs share one
+repo-scoped number space. Use the bare `#N` form for same-repo dependencies; use `owner/repo#N` for
+a dependency in a different repo.
+
+When creating an issue that depends on another, append a line like:
+```
+Depends on #42
+```
+to the body before calling `issue_write method: "create"`. There is no separate field or follow-up
+call — the rendering happens automatically once the body is saved.