fix(kyberforge): resolve PR #144 review and audit round 3

- factory-audit: hook events judged per deployed target after apm's
  rename (Claude/Copilot event sets FAIL, others SUGGESTION); Claude
  plugin layouts accepted as hook sources; interpreter options and
  sh -c strings checked; bats 378 -> 386
- primitive-author: Must 4/5 match the audit; reference hand-back
  points at the right steps; Step 4.2 --target all fallback
- skill-author: new-skill.sh repair only on the template marker line,
  so complete skills stay a no-op; provenance and calibration text
- forge: restore "already named" qualifier; drop false HITL claim
- apm-workflow: token example uses an env var
- docs/hooks.md: the apm-hooks.json sidecar is committed, not ignored

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/docs/hooks.md

@@ -68,7 +68,10 @@ At install, apm merges the event bindings into `.claude/settings.json`, copies t
 to `.claude/hooks/<pkg>/` (preserving its executable bit, preserving the `.apm/hooks/` subpath), and
 rewrites `command` to a `${CLAUDE_PROJECT_DIR}`-relative path. Ownership of its own entries is
 tracked in a `.claude/apm-hooks.json` sidecar, so an uninstall removes them without touching
-hand-authored hooks. Both `.claude/hooks/` and the sidecar are gitignored install output.
+hand-authored hooks. `.claude/hooks/` is gitignored install output; the sidecar is committed
+alongside `.claude/settings.json`, because without it a fresh clone's `apm install` treats the
+committed entry as user-owned and adds a duplicate, and `apm audit --ci` reports drift (ADR-0019,
+correction 2026-09-16).
 
 Note that apm's **executable-trust gate is off** unless the consuming project's `apm.yml` has an
 `executables:` block — without one, package hooks deploy with no prompt. The allow key carries a