fix(kyberforge): resolve PR #144 review and audit round 3

- factory-audit: hook events judged per deployed target after apm's
  rename (Claude/Copilot event sets FAIL, others SUGGESTION); Claude
  plugin layouts accepted as hook sources; interpreter options and
  sh -c strings checked; bats 378 -> 386
- primitive-author: Must 4/5 match the audit; reference hand-back
  points at the right steps; Step 4.2 --target all fallback
- skill-author: new-skill.sh repair only on the template marker line,
  so complete skills stay a no-op; provenance and calibration text
- forge: restore "already named" qualifier; drop false HITL claim
- apm-workflow: token example uses an env var
- docs/hooks.md: the apm-hooks.json sidecar is committed, not ignored

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/apm-workflow/references/configure.md

@@ -82,7 +82,7 @@ Any git repo is a valid package source by default — no registry required. To d
 ```bash
 apm experimental enable registries   # required first — see Gotchas
 apm config set registry.corp-main.url https://artifactory.corp.example.com/apm
-apm config set registry.corp-main.token eyJ...
+apm config set registry.corp-main.token "$CORP_APM_TOKEN"
 apm config set registry.corp-main.default true
 ```