chore(release): kyberforge 1.5.0, marketplace 0.4.0

Why
---
The SessionStart freshness hook is a new kyberforge feature and was committed
without a version bump. It also cannot ship unbumped: apm's executable-trust
allow key is version-pinned, so `kyberforge#1.4.1` would have stopped matching
the moment the package version moved, silently blocking the very hook the entry
exists to authorise.

Implementation notes
-----------------
kyberforge 1.4.1 -> 1.5.0 (MINOR, new feature); marketplace and root manifest
0.3.4 -> 0.4.0, following the convention in bb9158d where a package bump carries
the marketplace version with it. The executables.allow key moves to
kyberforge#1.5.0 in the same commit. Compiled manifests regenerated with
`apm pack` plus both sync scripts.

A bare `apm pack` also writes build/ and a root .claude-plugin/plugin.json,
neither of which is repo content — the pre-push gate only ever runs pack with
--dry-run, so they had not appeared before. Both removed; build/ is now
gitignored so a future release does not stage it by accident.

Impact
------
Consumers pinning kyberforge see a MINOR bump. All 15 pre-push hooks pass,
including apm pack --check-clean, so compiled output matches the manifests.

ADR: 0019

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

.claude-plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "name": "holocron",
   "description": "AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "owner": {
     "name": "Defame1297",
     "email": "defame1297@rkdr.net",
@@ -11,7 +11,7 @@
     {
       "name": "kyberforge",
       "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
-      "version": "1.4.1",
+      "version": "1.5.0",
       "category": "Developer Tools",
       "source": "./plugins/kyberforge"
     },

.github/plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "name": "holocron",
   "description": "AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "owner": {
     "name": "Defame1297",
     "email": "defame1297@rkdr.net",
@@ -11,7 +11,7 @@
     {
       "name": "kyberforge",
       "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
-      "version": "1.4.1",
+      "version": "1.5.0",
       "category": "Developer Tools",
       "source": "./plugins/kyberforge"
     },

.gitignore

@@ -40,3 +40,7 @@ apm_modules/
 # plugins/<name>/.apm/hooks/ (ADR-0019).
 .claude/hooks/
 .claude/apm-hooks.json
+
+# `apm pack` bundle output. The pre-push gate runs pack with --dry-run, so this
+# only appears after a bare `apm pack` during a release; it is not repo content.
+build/

apm.yml

@@ -1,5 +1,5 @@
 name: holocron
-version: 0.3.4
+version: 0.4.0
 description: AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
 license: MIT
 
@@ -42,7 +42,7 @@ dependencies:
 # after a kyberforge release, check this first.
 executables:
   allow:
-    kyberforge#1.4.1:
+    kyberforge#1.5.0:
       hooks: true
       bin: true
 
@@ -52,7 +52,7 @@ marketplace:
   # top-level apm.yml description:/version: above are NOT inherited into the
   # compiled output despite being used elsewhere (e.g. by `apm audit`).
   description: AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
-  version: 0.3.4
+  version: 0.4.0
   owner:
     name: Defame1297
     email: defame1297@rkdr.net
@@ -79,7 +79,7 @@ marketplace:
     - name: kyberforge
       description: Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
       source: ./plugins/kyberforge
-      version: 1.4.1
+      version: 1.5.0
       category: Developer Tools
 
     - name: bin

docs/adr/0019-session-start-hook-keeps-the-apm-install-current.md

@@ -66,7 +66,9 @@ no prompt and no record. The block added here closes that for this repo; every o
 this machine still has it open.
 
 **The allow key is version-pinned, and that is a live failure mode.** apm writes
-`kyberforge#1.4.1`, not `kyberforge`. A kyberforge version bump makes the entry stop matching, the
+`kyberforge#1.5.0`, not `kyberforge` — and the release that ships this hook proved the point
+immediately, since bumping kyberforge to 1.5.0 required editing the key in the same commit. A
+kyberforge version bump makes the entry stop matching, the
 gate blocks the hook, and the install silently stops refreshing — the exact failure this ADR exists
 to end, reintroduced through the mechanism meant to secure it. The `executables:` block carries a
 comment saying to check it first when skills go stale after a release.

plugins/kyberforge/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kyberforge",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
   "author": {
     "name": "Defame1297",

plugins/kyberforge/.github/plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kyberforge",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
   "author": {
     "name": "Defame1297",

plugins/kyberforge/apm.yml

@@ -1,5 +1,5 @@
 name: kyberforge
-version: 1.4.1
+version: 1.5.0
 description: Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
 author:
   name: Defame1297