feat(kyberforge): execute plugin-to-apm marketplace conversion

Why:
ADR-0015 established that Microsoft APM (apm.yml + .apm/) should replace
this repo's hand-authored plugin.json/marketplace.json model, with those
files becoming compiled output of `apm pack` instead of files edited by
hand via the (now-retired) plugin-author/marketplace-author skills.
Issue #90 was the deferred execution of that decision, gated on #88
(apm tooling) and #89 (apm-native agent-author/skill-author routing).

Implementation notes:
- All six plugins (bin, core, git, gitea, kyberforge, lint) now carry
  apm.yml + .apm/{skills,agents,hooks} as their authoring source. Skills
  moved with a plain git mv (content-identical across targets). Agents
  were re-authored, not moved: per ADR-0016, .apm/agents/*.agent.md
  compiles verbatim to both Claude and Copilot, so plugin-scope agents
  now carry only name/description/model/source_keys -- no tools: field,
  no Claude-only knobs (isolation, maxTurns, effort, memory,
  permissionMode).
- Root apm.yml registers all 7 marketplace packages (6 local plus
  mattpocock-skills as a remote entry) under versioning: per_package,
  matching this repo's existing independent-plugin-versioning practice.
- .claude-plugin/marketplace.json and every plugin's plugin.json are now
  apm-pack-compiled output, verified against the prior hand-maintained
  content: same names/descriptions/versions/licenses/authors, only
  cosmetic serialization differences (JSON key order, owner email vs.
  url, Unicode escaping).
- plugin-author and marketplace-author are retired now that apm-based
  authoring fully replaces their job; kyberforge bumped 1.3.1 -> 1.4.0
  for that removal, and the root marketplace catalog bumped
  0.3.1 -> 0.3.2 to match, per the version-bump convention now
  documented in apm-workflow's reference docs instead of a dedicated
  script (apm has no native version-bump automation).
- Fixed hardcoded pre-.apm/ path assumptions across
  .pre-commit-config.yaml, .pre-commit-hooks.yaml,
  scripts/check-scope-walkup-sync.sh, scripts/sync-vale-styles.sh,
  scripts/check-vale-style-sync.sh, six plugins' root plugin.json
  (stale skills/hooks/agents pointer fields that check-manifests.sh
  validates), and several tests/*.bats and tests/*.sh fixtures --
  including a bats REPO_ROOT relative-path depth bug (10 files, one
  extra .apm/ directory level to walk up) and a vale probe-path
  isolation regression introduced mid-fix.
- Corrected empirically-wrong assumptions surfaced this session in
  apm-workflow/apm-install's own reference docs: `apm marketplace
  package add` does not accept local paths (only owner/repo remote
  shorthand -- local packages are registered by editing apm.yml's
  marketplace.packages[] directly); `apm compile` is a consumer-side
  AGENTS.md/CLAUDE.md generator, not the plugin.json producer, and
  hard-fails on skill/agent-only packages without --clean; `apm plugin
  init <name>` nests a stray subdirectory when run with a positional
  name arg from inside a same-named directory; no native Copilot
  marketplace output profile exists; .mcp.json is merged into the
  compiled plugin.json content-aware and target-scoped, with no
  dependencies.mcp entry needed for simple passthrough; pipx is the
  correct pip fallback on externally-managed Python environments.
- Renamed agent-author's copilot.agent.md template asset to
  copilot.agent.md.template so apm compile's recursive *.agent.md glob
  stops misparsing the placeholder template as a real agent primitive.

Impact:
plugin.json and marketplace.json are compiled artifacts from here on --
editing them by hand is no longer the workflow; edit apm.yml/.apm/ and
run apm pack. CONTEXT.md's Plugin/Plugin marketplace glossary entries
reflect this. ADR-0001 is marked superseded, ADR-0006 moot, and
ADR-0010 updated for the new .apm/agents/ path (project/user scope
unaffected, per ADR-0016). Full local verification: claude plugin
validate --strict on all 6 plugins, apm audit --ci, apm marketplace
check, check-manifests.sh, and the full test suite (165/165 bats,
13/13 shell scripts) all pass clean.

Fixes: #90
Refs: #88, #89
ADR: 0015
ADR: 0016

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub96PyaSRD9BHPktotj1pC

plugins/git/.apm/skills/pc-run/references/README.md

@@ -0,0 +1,14 @@
+---
+source_keys:
+  - context7-pre-commit-com
+  - pre-commit-com
+  - context7-pre-commit-hooks
+  - pre-commit-hooks-github
+---
+
+# references/
+
+| File | Purpose |
+|---|---|
+| `failure-patterns.md` | Hook failure causes and concrete fix suggestions — loaded when hooks fail |
+| `sources.md` | Provenance: research sources that informed this skill |

plugins/git/.apm/skills/pc-run/references/failure-patterns.md

@@ -0,0 +1,130 @@
+---
+source_keys:
+  - context7-pre-commit-com
+  - pre-commit-com
+---
+
+# Hook Failure Patterns
+
+Common hook failure causes and concrete next-step suggestions.
+
+## Hook modified files — commit blocked
+
+Cause: A fixer hook (e.g. `trailing-whitespace`, `end-of-file-fixer`, `pretty-format-json`) modified staged files. The commit is blocked because the staged version is now stale.
+
+Fix: Re-stage and recommit.
+```bash
+git add -u
+git commit -m "same message"
+```
+
+## Secret detected (gitleaks)
+
+> Not sourced from the pre-commit research corpus (`context7-pre-commit-com`/`pre-commit-com` cover pre-commit itself, not gitleaks) — general tool knowledge, verify against gitleaks' own docs if precision matters.
+
+Cause: gitleaks found a high-entropy string or known secret pattern in a staged file.
+
+Suggestions:
+- If it's a false positive: add a `# gitleaks:allow` inline comment, or add the path to `.gitleaksignore`.
+- If it's a real secret: remove it from the file, rotate the credential, then commit.
+
+## Shellcheck warning
+
+> Not sourced from the pre-commit research corpus — general tool knowledge, verify against shellcheck's own docs if precision matters.
+
+Cause: shellcheck found a shell script issue. The output includes the file path, line number, and SC-code.
+
+Fix: Look up the SC-code on shellcheck.net or pass `--explain SCxxxx` to shellcheck for a detailed explanation. The most common fixes:
+- SC2086 (unquoted variable): wrap in double quotes.
+- SC2046 (unquoted command substitution): wrap in double quotes.
+- SC2181 (check exit code of `$?`): use `if command; then` directly.
+
+## `check-hooks-apply` fails
+
+Cause: A hook's `files`/`types` filter matches zero files in the repo — the hook is dead weight.
+
+Fix: Broaden the filter, or remove the hook if it no longer applies to this repo.
+
+## `check-useless-excludes` fails
+
+Cause: An `exclude` pattern matches no files.
+
+Fix: Remove or fix the pattern.
+
+## SSH cloning fails in CI
+
+Cause: The CI environment lacks SSH credentials to clone hook repos over SSH.
+
+Fix: Export `SSH_AUTH_SOCK` in the CI environment, or switch hook repo URLs to HTTPS.
+
+## HTTP proxy needed
+
+Cause: The CI/sandbox network requires a proxy to reach hook repos.
+
+Fix:
+```bash
+export http_proxy=http://proxy.example.com:3128
+export https_proxy=http://proxy.example.com:3128
+export no_proxy=localhost,127.0.0.1
+```
+
+## `rev` is a branch name — `autoupdate` broke it
+
+Cause: Branch refs are mutable and drift over time; pre-commit resolves them once at install time, so pinning to a branch name (instead of a tag or commit SHA) leads to silent version drift.
+
+Fix:
+```bash
+pre-commit autoupdate     # finds the latest tag and rewrites rev in place
+```
+
+## pretty-format-json fails but doesn't fix
+
+Cause: `pretty-format-json` requires `args: [--autofix]` to modify files. Without it, the hook only fails.
+
+Fix: The user (or `pc-author`) must add `args: [--autofix]` to the hook override in `.pre-commit-config.yaml`.
+
+## Environment stale or broken
+
+Cause: A hook's cached environment is corrupted or out of date.
+
+Fix:
+```bash
+pre-commit clean          # wipe all environments
+pre-commit install-hooks  # rebuild everything
+```
+
+Or less destructively:
+```bash
+pre-commit gc             # remove only unused environments
+```
+
+## Hooks don't run on `git commit`
+
+Cause: `pre-commit install` was never run in this clone.
+
+Fix: `pre-commit install`. Git hooks are per-clone — they are not committed to the repo.
+
+## Hook runs but matches wrong files (or no files)
+
+Cause: The `files:` pattern uses `re.search()` not full-string match. A pattern that looks correct may match unexpectedly.
+
+Diagnosis: `identify-cli <filename>` shows the type tags for a file. Verify `types:` filters against these.
+
+## stages mismatch — hook never fires
+
+Cause: Hook is defined for a stage (e.g. `pre-push`) but `pre-commit install` was not run with `-t pre-push`.
+
+Fix:
+```bash
+pre-commit install -t pre-commit -t pre-push -t commit-msg
+```
+
+Or add `default_install_hook_types` to `.pre-commit-config.yaml` and re-run `pre-commit install`.
+
+## `validate-config` schema error
+
+Common causes:
+- Missing `id` under a hook block
+- Missing `rev` under a non-local repo block
+- `repo: local` hook missing `language` or `entry`
+- Indentation error (valid YAML but invalid pre-commit schema)

plugins/git/.apm/skills/pc-run/references/sources.md

@@ -0,0 +1,33 @@
+# Sources
+
+## context7-pre-commit-com
+
+- **URL:** context7:/pre-commit/pre-commit.com
+- **Description:** Official pre-commit.com documentation — installation, configuration schema, CLI reference, hook authoring, advanced features, troubleshooting
+- **Contributing files:** SKILL.md, references/failure-patterns.md
+- **Research doc:** plugins/git/docs/research/docs/pre-commit/{overview,cli-reference,troubleshooting}.md
+- **Status:** `extracted`
+
+## pre-commit-com
+
+- **URL:** https://pre-commit.com/
+- **Description:** Pre-commit framework homepage — full docs covering install, config, CLI, hook authoring, stages, local hooks, meta hooks, hazmat helpers, CI integration
+- **Contributing files:** SKILL.md, references/failure-patterns.md
+- **Research doc:** plugins/git/docs/research/docs/pre-commit/{overview,cli-reference,troubleshooting}.md
+- **Status:** `extracted`
+
+## context7-pre-commit-hooks
+
+- **URL:** context7:/pre-commit/pre-commit-hooks
+- **Description:** Official pre-commit-hooks collection — all available hook IDs with options and examples
+- **Contributing files:** (none)
+- **Research doc:** plugins/git/docs/research/docs/pre-commit/hooks-reference.md § "pre-commit-hooks (official collection)"
+- **Status:** `extracted`
+
+## pre-commit-hooks-github
+
+- **URL:** https://raw.githubusercontent.com/pre-commit/pre-commit-hooks/main/README.md
+- **Description:** Official pre-commit-hooks README — complete hook listing with all args, categories, deprecated hooks, and latest version
+- **Contributing files:** (none)
+- **Research doc:** plugins/git/docs/research/docs/pre-commit/hooks-reference.md § "pre-commit-hooks (official collection)"
+- **Status:** `extracted`