fix(kyberforge): bridge apm content to Claude Code's flat plugin discovery

Claude Code's (and Copilot's) native plugin installer has zero awareness of
.apm/ nesting -- it convention-scans only flat skills/, agents/, commands/,
hooks.json at each plugin's root. Confirmed via strings on the installed
claude binary and live installs of git@holocron/gitea@holocron/kyberforge@
holocron, all reporting Skills(0) Agents(0) Hooks(0) post ADR-0015's apm
conversion. Root cause (apm_cli/core/plugin_manifest.py): apm's plugin.json
compiler deliberately strips skills/agents/commands keys, assuming the host
already auto-discovers those convention directories -- it has no model of
.apm/ being host-visible at all. Separately, apm's own bundle exporter
(apm_cli/bundle/plugin_exporter.py, behind `apm pack --format plugin`)
implements the correct .apm/ -> flat mapping, but only ever targeted
build/<name>-<version>/, a path nothing in marketplace.json's source: points
at.

scripts/sync-plugin-content.sh wraps that bundle exporter and copies its
agents/, skills/, commands/, instructions/, extensions/, and merged
hooks.json back into each plugin's own root as a second tracked
compiled-output category -- same governance status as
.claude-plugin/plugin.json: generated from .apm/, never hand-edited. tests/
subdirectories are excluded from the mirror (dev fixtures, not host-visible
runtime content; several hardcode a relative repo-root walk-up sized for the
.apm/-nested depth, which breaks when duplicated one level shallower).
Applied for real across all 6 plugins and verified two ways: `claude plugin
validate --strict` passes on every real plugin directory, and a live
`claude --plugin-dir <path> -p "list skills/agents"` behavioral test
confirms content is now actually discovered.

Also, from the same issue #90 review round:
- scripts/check-manifests.sh pointed at each plugin's root-level plugin.json
  (checking skills/hooks/mcpServers/agents pointer fields) -- that file was a
  stale near-duplicate of .claude-plugin/plugin.json nothing else read or
  wrote, now deleted across all 6 plugins. check-manifests.sh is rewritten to
  validate .claude-plugin/plugin.json instead, and drops the pointer-field
  checks entirely (nothing to check -- those fields are correctly absent by
  design). Content-presence drift is now check-plugin-content-sync's job, a
  new pre-push hook wired in .pre-commit-config.yaml.

docs/adr/0017 records the root cause and decision in full, including two
rejected alternatives (patching plugin.json's path fields directly -- apm's
compiler strips them on every run; pointing marketplace.json at apm pack's
build/ output -- a version-suffixed non-source directory nothing can install
from without an extra build step). ADR-0015 and CONTEXT.md are updated to
point at it.

Refs: #90

plugins/gitea/skills/gitea-issues/references/issues.md

@@ -0,0 +1,123 @@
+---
+topic: issues
+source_keys:
+  - gitea-mcp-repo
+  - gitea-mcp-slim-go
+---
+
+# Issue operations
+
+Call signatures below were verified live against the deployed `gitea-mcp` server via `ToolSearch`
+at authoring time, not copied from `api-reference.md` — this is deliberate: research docs are
+generated from source at a point in time and can drift from the server actually deployed (see the
+`list_issues` gotcha below, which is the exact drift this policy exists to catch). Re-verify against
+the live schema if these tools appear to behave differently than documented here.
+
+## `list_issues`
+
+**Parameters (live schema):**
+- `owner` (string, required)
+- `repo` (string, required)
+- `state` (string, optional, default `"all"`) — conventional values `"open"`/`"closed"`/`"all"`, not
+  schema-enforced as an enum
+- `labels` (array of strings, optional) — filter by label *name* (not ID)
+- `since` (string, optional) — ISO 8601, issues updated after this time
+- `before` (string, optional) — ISO 8601, issues updated before this time
+- `page` (number, optional, default `1`)
+- `per_page` (number, optional, default `30`)
+
+**There is no `type` parameter and no `milestones` parameter**, despite both appearing in
+`api-reference.md`. This tool cannot filter issues-vs-PRs or by milestone — see the Gotchas section
+of SKILL.md for the consequence (PR entries can appear in results with no way to exclude them here).
+
+**Call:**
+```
+list_issues owner: <owner> repo: <repo> state: "open"
+```
+
+**Response (list item):** `number`, `title`, `state`, `html_url`, `user`, `comments`, `created_at`,
+`updated_at`, and optionally `labels` (`[]string`), `milestone` (`{id, title}`), `ref`, `deadline`.
+Body and `closed_at` are omitted from list responses — call `issue_read method: "get"` for those.
+
+Paginate with `page`/`per_page` until the returned count is less than `per_page`.
+
+## `issue_read`
+
+**Parameters (live schema, matches `api-reference.md`):**
+- `method` (string, required, enum) — `"get"` | `"get_comments"` | `"get_labels"`
+- `owner` (string, required)
+- `repo` (string, required)
+- `issue_number` (number, required)
+
+**`get`** — full issue: `number`, `title`, `body`, `state`, `html_url`, `user`, `labels`
+(`[]string`), `comments`, `created_at`, `updated_at`, `closed_at`, and optionally `assignees`
+(`[]string`), `milestone` (`{id, title}`), `ref`, `deadline`, `is_pull` (present only when this
+number is backed by a pull request — absent, not `false`, on true issues).
+
+**`get_comments`** — array of `{id, body, user, html_url, created_at, updated_at}`.
+
+**`get_labels`** — array of full label objects (`id`, `name`, `color`, `description` — not slimmed
+to name strings, unlike the labels array on `get`).
+
+**Call:**
+```
+issue_read method: "get" owner: <owner> repo: <repo> issue_number: <N>
+```
+
+Always check `is_pull` before treating a number as a plain issue — see the shared number-space
+gotcha in SKILL.md.
+
+## `issue_write`
+
+**Parameters (live schema, matches `api-reference.md`):**
+- `method` (string, required, enum) — `"create"` | `"update"` | `"add_comment"` | `"edit_comment"` |
+  `"add_labels"` | `"remove_label"` | `"replace_labels"` | `"clear_labels"`
+- `owner` (string, required)
+- `repo` (string, required)
+- `issue_number` (number, required for every method except `"create"`)
+- `title` (string, required for `"create"`)
+- `body` (string, required for `"create"`, `"add_comment"`, `"edit_comment"`)
+- `assignees` (array of strings, optional) — login names (see `references/enrichments.md` for why
+  this is usually omitted)
+- `milestone` (number, optional) — milestone ID, never a title
+- `state` (string, enum `"open"`/`"closed"`/`"all"`, optional) — for `"update"`
+- `commentID` (number, optional, required for `"edit_comment"`)
+- `labels` (array of numbers, optional) — label IDs, never names — for `add_labels`/`replace_labels`
+- `label_id` (number, optional, required for `"remove_label"`) — singular, not the array form
+- `ref` (string, optional) — branch association, informational only
+- `deadline` (string, optional) — ISO 8601
+- `remove_deadline` (boolean, optional)
+
+**Create:**
+```
+issue_write method: "create"
+  owner: <owner> repo: <repo>
+  title: <title> body: <body>
+  labels: [<resolved IDs>]        ← omit if none confidently inferred
+  milestone: <resolved ID>        ← omit if none clearly fits
+  assignees: ["<login>"]          ← omit if no default configured
+```
+
+**Close:**
+```
+issue_write method: "update" owner: <owner> repo: <repo> issue_number: <N> state: "closed"
+```
+There is no `method: "close"` — using one will error.
+
+**Comment:**
+```
+issue_write method: "add_comment" owner: <owner> repo: <repo> issue_number: <N> body: <text>
+```
+
+**Apply resolved label IDs directly** (bypassing `references/enrichments.md`'s inference step, e.g.
+when the caller already named exact labels):
+```
+issue_write method: "add_labels" owner: <owner> repo: <repo> issue_number: <N> labels: [<IDs>]
+```
+To replace all labels atomically instead of adding: `method: "replace_labels"`.
+To remove one: `method: "remove_label" label_id: <single ID>`.
+
+## Token scope
+
+All of `list_issues`, `issue_read`, and `issue_write` are verified working under a token holding
+`write:issue` + `write:repository`.