fix(kyberforge): bridge apm content to Claude Code's flat plugin discovery

Claude Code's (and Copilot's) native plugin installer has zero awareness of
.apm/ nesting -- it convention-scans only flat skills/, agents/, commands/,
hooks.json at each plugin's root. Confirmed via strings on the installed
claude binary and live installs of git@holocron/gitea@holocron/kyberforge@
holocron, all reporting Skills(0) Agents(0) Hooks(0) post ADR-0015's apm
conversion. Root cause (apm_cli/core/plugin_manifest.py): apm's plugin.json
compiler deliberately strips skills/agents/commands keys, assuming the host
already auto-discovers those convention directories -- it has no model of
.apm/ being host-visible at all. Separately, apm's own bundle exporter
(apm_cli/bundle/plugin_exporter.py, behind `apm pack --format plugin`)
implements the correct .apm/ -> flat mapping, but only ever targeted
build/<name>-<version>/, a path nothing in marketplace.json's source: points
at.

scripts/sync-plugin-content.sh wraps that bundle exporter and copies its
agents/, skills/, commands/, instructions/, extensions/, and merged
hooks.json back into each plugin's own root as a second tracked
compiled-output category -- same governance status as
.claude-plugin/plugin.json: generated from .apm/, never hand-edited. tests/
subdirectories are excluded from the mirror (dev fixtures, not host-visible
runtime content; several hardcode a relative repo-root walk-up sized for the
.apm/-nested depth, which breaks when duplicated one level shallower).
Applied for real across all 6 plugins and verified two ways: `claude plugin
validate --strict` passes on every real plugin directory, and a live
`claude --plugin-dir <path> -p "list skills/agents"` behavioral test
confirms content is now actually discovered.

Also, from the same issue #90 review round:
- scripts/check-manifests.sh pointed at each plugin's root-level plugin.json
  (checking skills/hooks/mcpServers/agents pointer fields) -- that file was a
  stale near-duplicate of .claude-plugin/plugin.json nothing else read or
  wrote, now deleted across all 6 plugins. check-manifests.sh is rewritten to
  validate .claude-plugin/plugin.json instead, and drops the pointer-field
  checks entirely (nothing to check -- those fields are correctly absent by
  design). Content-presence drift is now check-plugin-content-sync's job, a
  new pre-push hook wired in .pre-commit-config.yaml.

docs/adr/0017 records the root cause and decision in full, including two
rejected alternatives (patching plugin.json's path fields directly -- apm's
compiler strips them on every run; pointing marketplace.json at apm pack's
build/ output -- a version-suffixed non-source directory nothing can install
from without an extra build step). ADR-0015 and CONTEXT.md are updated to
point at it.

Refs: #90

tests/test-check-manifests.sh

@@ -9,13 +9,17 @@ FAIL=0
 pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
 fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
 
-# Helper: make a minimal valid repo fixture with marketplace + plugin structure
+# Helper: make a minimal valid repo fixture with marketplace + plugin structure.
+# Per ADR-0015/ADR-0017, the manifest check-manifests.sh validates is
+# .claude-plugin/plugin.json (compiled output) -- not the root-level plugin.json,
+# which was deleted repo-wide, and not the skills/hooks/mcpServers/agents pointer
+# fields apm's compiler deliberately never populates (see scripts/check-manifests.sh's
+# own header comment). Content-presence drift is scripts/sync-plugin-content.sh's job.
 make_valid_fixture() {
   local dir
   dir="$(mktemp -d)"
   mkdir -p "$dir/.claude-plugin"
-  mkdir -p "$dir/plugins/myplugin/skills/my-skill"
-  mkdir -p "$dir/plugins/myplugin/agents"
+  mkdir -p "$dir/plugins/myplugin/.claude-plugin"
   cat > "$dir/.claude-plugin/marketplace.json" <<'JSON'
 {
   "name": "test-marketplace",
@@ -24,15 +28,11 @@ make_valid_fixture() {
   ]
 }
 JSON
-  cat > "$dir/plugins/myplugin/plugin.json" <<'JSON'
+  cat > "$dir/plugins/myplugin/.claude-plugin/plugin.json" <<'JSON'
 {
-  "name": "myplugin",
-  "skills": ["skills/"],
-  "agents": "agents/",
-  "hooks": "hooks.json"
+  "name": "myplugin"
 }
 JSON
-  touch "$dir/plugins/myplugin/hooks.json"
   echo "$dir"
 }
 
@@ -67,9 +67,9 @@ else
   pass "exits non-zero when plugin source directory does not exist"
 fi
 
-# --- 3. Exits 1 when plugin.json is missing from plugin dir ---
+# --- 3. Exits 1 when .claude-plugin/plugin.json is missing from plugin dir ---
 echo ""
-echo "--- exits 1 when plugin.json missing from plugin directory ---"
+echo "--- exits 1 when .claude-plugin/plugin.json missing from plugin directory ---"
 FIXTURE3="$(mktemp -d)"
 trap 'rm -rf "$FIXTURE3"' EXIT
 mkdir -p "$FIXTURE3/.claude-plugin"
@@ -83,63 +83,34 @@ cat > "$FIXTURE3/.claude-plugin/marketplace.json" <<'JSON'
 }
 JSON
 if bash "$SCRIPT" "$FIXTURE3" > /dev/null 2>&1; then
-  fail "exited 0 when plugin.json is missing — expected exit 1"
+  fail "exited 0 when .claude-plugin/plugin.json is missing — expected exit 1"
 else
-  pass "exits non-zero when plugin.json is missing from plugin directory"
+  pass "exits non-zero when .claude-plugin/plugin.json is missing from plugin directory"
 fi
 
-# --- 4. Exits 1 when a skills directory listed in plugin.json does not exist ---
+# --- 4. Exits 1 when a remote-source plugin entry's local plugin still lacks a manifest ---
+# Remote sources (object-typed `source:`) are skipped entirely; only string (local path)
+# sources are checked. This guards that a mixed marketplace.json still catches a broken
+# local entry alongside a legitimately-skipped remote one.
 echo ""
-echo "--- exits 1 when skills directory missing ---"
+echo "--- exits 1 for a broken local entry even when a remote entry is present ---"
 FIXTURE4="$(mktemp -d)"
 trap 'rm -rf "$FIXTURE4"' EXIT
 mkdir -p "$FIXTURE4/.claude-plugin"
-mkdir -p "$FIXTURE4/plugins/myplugin"
+mkdir -p "$FIXTURE4/plugins/broken"
 cat > "$FIXTURE4/.claude-plugin/marketplace.json" <<'JSON'
 {
   "name": "test-marketplace",
   "plugins": [
-    { "name": "myplugin", "source": "./plugins/myplugin" }
+    { "name": "remote-thing", "source": { "repo": "someorg/somerepo", "source": "github" } },
+    { "name": "broken", "source": "./plugins/broken" }
   ]
 }
 JSON
-cat > "$FIXTURE4/plugins/myplugin/plugin.json" <<'JSON'
-{
-  "name": "myplugin",
-  "skills": ["skills/"]
-}
-JSON
 if bash "$SCRIPT" "$FIXTURE4" > /dev/null 2>&1; then
-  fail "exited 0 when skills dir missing — expected exit 1"
+  fail "exited 0 with a broken local entry present — expected exit 1"
 else
-  pass "exits non-zero when skills directory referenced in plugin.json does not exist"
-fi
-
-# --- 5. Exits 1 when a file referenced in plugin.json (hooks) does not exist ---
-echo ""
-echo "--- exits 1 when referenced hooks file missing ---"
-FIXTURE5="$(mktemp -d)"
-trap 'rm -rf "$FIXTURE5"' EXIT
-mkdir -p "$FIXTURE5/.claude-plugin"
-mkdir -p "$FIXTURE5/plugins/myplugin/skills"
-cat > "$FIXTURE5/.claude-plugin/marketplace.json" <<'JSON'
-{
-  "name": "test-marketplace",
-  "plugins": [
-    { "name": "myplugin", "source": "./plugins/myplugin" }
-  ]
-}
-JSON
-cat > "$FIXTURE5/plugins/myplugin/plugin.json" <<'JSON'
-{
-  "name": "myplugin",
-  "hooks": "hooks.json"
-}
-JSON
-if bash "$SCRIPT" "$FIXTURE5" > /dev/null 2>&1; then
-  fail "exited 0 when hooks file missing — expected exit 1"
-else
-  pass "exits non-zero when file referenced in plugin.json does not exist"
+  pass "exits non-zero for a broken local entry even alongside a skipped remote entry"
 fi
 
 echo ""