refactor(kyberforge): make skill-write and skill-audit self-contained with shared resources

- Move validate.sh ownership to skill-audit/scripts/ — it is the canonical
  structural validator; skill-write now delegates Step 5 to /skill-audit
- Add skill-write/references/scripts.md and deployment-modes.md for progressive
  disclosure of package runner patterns and plugin cache isolation rules
- Fix skill-audit Step 1 cross-skill path reference (was repo-absolute, now
  skill-relative); add manual fallback for sandboxed/Bash-denied contexts
- Scope Step 2 "read every file" to exclude binaries and unreferenced files
- Fix new-skill.sh next-steps output to reference /skill-audit instead of
  the removed validate.sh
- Remove stale Dependencies section from skill-audit README; flip dependency
  arrow — skill-write depends on skill-audit, not vice versa

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

plugins/kyberforge/skills/skill-write/references/deployment-modes.md

@@ -0,0 +1,38 @@
+# Deployment Modes
+
+Skills deploy in two modes. Both resolve relative paths from the skill root — the SKILL.md body works the same in either. Differences only arise when referencing files *outside* the skill directory.
+
+## Cache isolation (plugin mode)
+
+When a plugin is installed, its directory is copied to a cache. Only the plugin's own files are copied. **Any path that leaves the skill directory breaks post-install:**
+
+```
+../other-skill/validate.sh              # breaks
+plugins/kyberforge/skills/other-skill/  # breaks
+../../shared/utils.sh                   # breaks
+```
+
+Fix: duplicate the file into the skill's own `scripts/` or `assets/`. There is no plugin-level `shared/` mechanism — the spec defines no cross-skill sharing, and `../` paths are broken by construction.
+
+## Env vars (plugin mode only)
+
+These variables are injected when the plugin is loaded from an install cache. They are **not available in standalone mode.**
+
+| Variable | Value |
+|----------|-------|
+| `${CLAUDE_PLUGIN_ROOT}` | Absolute path to the plugin's install directory. Changes on update. |
+| `${CLAUDE_PLUGIN_DATA}` | Persistent directory that survives updates. Use for `node_modules`, generated state, caches. |
+
+Use `${CLAUDE_PLUGIN_ROOT}` only in hook commands and `.mcp.json` configs — not in SKILL.md body text, since standalone deployments won't have it.
+
+## Standalone mode
+
+Deployed directly to `~/.agents/skills/<name>/`. No plugin context, no env vars injected. All file references must resolve within the skill directory. Skill invocations (e.g. `/skill-audit`) work if the called skill is also installed.
+
+## Cross-tool portability
+
+`SKILL.md` is portable — the same file works in Claude Code and Copilot CLI. Agent definitions and manifest files (`plugin.json`, `hooks.json`) are tool-specific and must be authored separately per tool.
+
+## Shared assets between skills
+
+If two skills in the same plugin need the same file, duplicate it into each skill's `assets/` or `scripts/`. Add a comment in both copies noting the mirror relationship so they stay in sync when the spec changes.

plugins/kyberforge/skills/skill-write/references/scripts.md

@@ -0,0 +1,68 @@
+# Scripts Reference
+
+## Package runners (no install required)
+
+When an existing package does what you need, use a runner directly in SKILL.md without writing a script file.
+
+| Runner | Language | Notes |
+|--------|----------|-------|
+| `uvx package@version` | Python | Recommended. Aggressive caching via uv. |
+| `pipx run 'package==version'` | Python | Broader OS availability. |
+| `npx package@version` | Node.js | Ships with npm/Node.js. |
+| `bunx package@version` | Node.js | Bun environments only. |
+| `deno run npm:package@version` | TypeScript | Requires permission flags (`--allow-read`, etc.). |
+| `go run golang.org/x/...@version` | Go | Built into Go toolchain. |
+
+Always pin versions. Never use `pip install` or `npm install -g` at runtime — they are not idempotent and pollute the environment.
+
+## Inline dependency patterns
+
+Use these when the script requires packages but should remain a single portable file.
+
+**Python (PEP 723 + uv):**
+```python
+# /// script
+# dependencies = [
+#   "beautifulsoup4>=4.12,<5",
+# ]
+# requires-python = ">=3.12"
+# ///
+from bs4 import BeautifulSoup
+```
+```bash
+uv run scripts/extract.py
+```
+
+**TypeScript (Deno):**
+```typescript
+#!/usr/bin/env -S deno run
+import * as cheerio from "npm:cheerio@1.0.0";
+```
+```bash
+deno run scripts/extract.ts
+```
+
+**TypeScript (Bun):**
+```typescript
+#!/usr/bin/env bun
+import * as cheerio from "cheerio@1.0.0";
+```
+```bash
+bun run scripts/extract.ts
+```
+
+**Ruby (bundler/inline):**
+```ruby
+require 'bundler/inline'
+gemfile do
+  source 'https://rubygems.org'
+  gem 'nokogiri', '~> 1.16'
+end
+```
+```bash
+ruby scripts/extract.rb
+```
+
+## Output size
+
+Many harnesses truncate tool output beyond 10–30K characters. Default to a summary or a reasonable output limit. For scripts that can produce large output: support `--offset N` for pagination, or use `--output FILE` to write to disk and keep stdout clean.