fix(kyberforge): resolve PR #144 review and audit round 3

- factory-audit: hook events judged per deployed target after apm's
  rename (Claude/Copilot event sets FAIL, others SUGGESTION); Claude
  plugin layouts accepted as hook sources; interpreter options and
  sh -c strings checked; bats 378 -> 386
- primitive-author: Must 4/5 match the audit; reference hand-back
  points at the right steps; Step 4.2 --target all fallback
- skill-author: new-skill.sh repair only on the template marker line,
  so complete skills stay a no-op; provenance and calibration text
- forge: restore "already named" qualifier; drop false HITL claim
- apm-workflow: token example uses an env var
- docs/hooks.md: the apm-hooks.json sidecar is committed, not ignored

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/skill-author/scripts/new-skill.sh

@@ -153,39 +153,49 @@ else
   TARGET="$TARGET_INPUT/$SKILL_NAME"
 fi
 
-# Files carrying the SKILL_NAME placeholder token.
+# Files carrying the SKILL_NAME placeholder token, each paired with the exact
+# template line that marks it as still unsubstituted. Only that whole line
+# counts: a finished skill may legitimately mention SKILL_NAME in its prose.
 SUBST_FILES=("SKILL.md" "tests/README.md")
+SUBST_MARKERS=("name: SKILL_NAME" "bats <destination-dir>/SKILL_NAME/tests/")
 
-# Replace SKILL_NAME in each placeholder file under dir $1. `sed -i` is not
-# portable — GNU takes an optional attached suffix, BSD/macOS requires a
-# separate suffix argument and reads the expression as one — so write to a
-# temp file and move it over the original instead.
-substitute_name() {
-  local dir="$1" rel f
-  for rel in "${SUBST_FILES[@]}"; do
-    f="$dir/$rel"
-    [[ -f "$f" ]] || continue
-    sed "s/SKILL_NAME/$SKILL_NAME/g" "$f" > "$f.tmp"
-    mv "$f.tmp" "$f"
-  done
+# Replace SKILL_NAME in one file. `sed -i` is not portable — GNU takes an
+# optional attached suffix, BSD/macOS requires a separate suffix argument and
+# reads the expression as one — so write to a temp file and move it over.
+substitute_file() {
+  local f="$1"
+  sed "s/SKILL_NAME/$SKILL_NAME/g" "$f" > "$f.tmp"
+  mv "$f.tmp" "$f"
 }
 
-# True if any placeholder file under dir $1 still carries the SKILL_NAME token.
-has_placeholder() {
+# Substitute every placeholder file under dir $1 (a fresh template copy).
+substitute_name() {
   local dir="$1" rel
   for rel in "${SUBST_FILES[@]}"; do
-    if [[ -f "$dir/$rel" ]] && grep -q 'SKILL_NAME' "$dir/$rel"; then
-      return 0
+    [[ -f "$dir/$rel" ]] && substitute_file "$dir/$rel"
+  done
+  return 0
+}
+
+# Substitute only the placeholder files under dir $1 that still carry their
+# template marker line; print how many were repaired.
+repair_placeholders() {
+  local dir="$1" i f n=0
+  for i in "${!SUBST_FILES[@]}"; do
+    f="$dir/${SUBST_FILES[$i]}"
+    if [[ -f "$f" ]] && grep -qxF "${SUBST_MARKERS[$i]}" "$f"; then
+      substitute_file "$f"
+      n=$((n + 1))
     fi
   done
-  return 1
+  echo "$n"
 }
 
 if [[ -d "$TARGET" ]]; then
-  # A scaffold left half-built by an earlier failed run still carries the
-  # placeholder token; finish it instead of reporting a silent no-op.
-  if has_placeholder "$TARGET"; then
-    substitute_name "$TARGET"
+  # A scaffold left half-built by an earlier failed run still carries a
+  # template marker line; finish it instead of reporting a silent no-op.
+  # Anything else — including a complete skill — is left untouched.
+  if [[ "$(repair_placeholders "$TARGET")" -gt 0 ]]; then
     echo "Repaired partial scaffold at '$TARGET' — substituted SKILL_NAME." >&2
     exit 0
   fi