feat(kyberforge): execute plugin-to-apm marketplace conversion

Why:
ADR-0015 established that Microsoft APM (apm.yml + .apm/) should replace
this repo's hand-authored plugin.json/marketplace.json model, with those
files becoming compiled output of `apm pack` instead of files edited by
hand via the (now-retired) plugin-author/marketplace-author skills.
Issue #90 was the deferred execution of that decision, gated on #88
(apm tooling) and #89 (apm-native agent-author/skill-author routing).

Implementation notes:
- All six plugins (bin, core, git, gitea, kyberforge, lint) now carry
  apm.yml + .apm/{skills,agents,hooks} as their authoring source. Skills
  moved with a plain git mv (content-identical across targets). Agents
  were re-authored, not moved: per ADR-0016, .apm/agents/*.agent.md
  compiles verbatim to both Claude and Copilot, so plugin-scope agents
  now carry only name/description/model/source_keys -- no tools: field,
  no Claude-only knobs (isolation, maxTurns, effort, memory,
  permissionMode).
- Root apm.yml registers all 7 marketplace packages (6 local plus
  mattpocock-skills as a remote entry) under versioning: per_package,
  matching this repo's existing independent-plugin-versioning practice.
- .claude-plugin/marketplace.json and every plugin's plugin.json are now
  apm-pack-compiled output, verified against the prior hand-maintained
  content: same names/descriptions/versions/licenses/authors, only
  cosmetic serialization differences (JSON key order, owner email vs.
  url, Unicode escaping).
- plugin-author and marketplace-author are retired now that apm-based
  authoring fully replaces their job; kyberforge bumped 1.3.1 -> 1.4.0
  for that removal, and the root marketplace catalog bumped
  0.3.1 -> 0.3.2 to match, per the version-bump convention now
  documented in apm-workflow's reference docs instead of a dedicated
  script (apm has no native version-bump automation).
- Fixed hardcoded pre-.apm/ path assumptions across
  .pre-commit-config.yaml, .pre-commit-hooks.yaml,
  scripts/check-scope-walkup-sync.sh, scripts/sync-vale-styles.sh,
  scripts/check-vale-style-sync.sh, six plugins' root plugin.json
  (stale skills/hooks/agents pointer fields that check-manifests.sh
  validates), and several tests/*.bats and tests/*.sh fixtures --
  including a bats REPO_ROOT relative-path depth bug (10 files, one
  extra .apm/ directory level to walk up) and a vale probe-path
  isolation regression introduced mid-fix.
- Corrected empirically-wrong assumptions surfaced this session in
  apm-workflow/apm-install's own reference docs: `apm marketplace
  package add` does not accept local paths (only owner/repo remote
  shorthand -- local packages are registered by editing apm.yml's
  marketplace.packages[] directly); `apm compile` is a consumer-side
  AGENTS.md/CLAUDE.md generator, not the plugin.json producer, and
  hard-fails on skill/agent-only packages without --clean; `apm plugin
  init <name>` nests a stray subdirectory when run with a positional
  name arg from inside a same-named directory; no native Copilot
  marketplace output profile exists; .mcp.json is merged into the
  compiled plugin.json content-aware and target-scoped, with no
  dependencies.mcp entry needed for simple passthrough; pipx is the
  correct pip fallback on externally-managed Python environments.
- Renamed agent-author's copilot.agent.md template asset to
  copilot.agent.md.template so apm compile's recursive *.agent.md glob
  stops misparsing the placeholder template as a real agent primitive.

Impact:
plugin.json and marketplace.json are compiled artifacts from here on --
editing them by hand is no longer the workflow; edit apm.yml/.apm/ and
run apm pack. CONTEXT.md's Plugin/Plugin marketplace glossary entries
reflect this. ADR-0001 is marked superseded, ADR-0006 moot, and
ADR-0010 updated for the new .apm/agents/ path (project/user scope
unaffected, per ADR-0016). Full local verification: claude plugin
validate --strict on all 6 plugins, apm audit --ci, apm marketplace
check, check-manifests.sh, and the full test suite (165/165 bats,
13/13 shell scripts) all pass clean.

Fixes: #90
Refs: #88, #89
ADR: 0015
ADR: 0016

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub96PyaSRD9BHPktotj1pC

plugins/gitea/.apm/agents/gitea-orchestrate.agent.md

@@ -3,8 +3,6 @@ name: gitea-orchestrate
 
 description: Orchestrates Gitea operations for other agents. Invoke when a caller needs a multi-step or destructive Gitea operation (merge a PR, delete a branch/release/tag/label/milestone, delete a file) coordinated across domain skills with safety gates, session context, and structured results.
 
-tools: ["execute", "read"]
-
 source_keys:
   - gitea-mcp-repo
   - gitea-mcp-slim-go
@@ -44,7 +42,7 @@ Sub-skills carry their own local copies of relevant gotchas for humans who invok
 When invoked, you:
 1. Parse the incoming workflow request (operation type, parameters, context overrides)
 2. Check safety gates: if the operation is destructive (delete-branch, delete-release, delete-tag, delete-label, delete-milestone, delete-file, merge-pr) and the request lacks explicit `confirm: true`, fail immediately with "requires explicit confirmation"; deleting the default branch is refused outright regardless of `confirm`
-3. Route to the appropriate domain skill: gitea-issues, gitea-labels-milestones, gitea-prs, gitea-branches, gitea-files, gitea-releases
+3. Route to the appropriate domain skill: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`
 4. Manage session context: resolve and carry forward `owner`/`repo` and any cached number-space resolutions, passing them explicitly to each skill
 5. Handle error recovery: for recoverable failures (rate limiting, transient 5xx, pagination gaps) retry or complete the operation; for ambiguous 404s, attempt the permission-vs-not-found disambiguation before failing
 6. Aggregate results and return structured JSON output suitable for agent chaining
@@ -69,11 +67,27 @@ When invoked, you:
 3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
 4. Resolve `owner`/`repo` via `git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
 5. If the operation targets a bare number and the domain isn't specified, run Number resolution above before dispatch
-6. Invoke the appropriate domain skill with the operation, parameters, and resolved context (`owner`, `repo`)
+6. Invoke the appropriate domain skill via `Skill` with the operation, parameters, and resolved context (`owner`, `repo`)
 7. Catch and handle Gitea errors: disambiguate 404s (not-found vs. permission-hidden), retry transient failures, loop pagination for `list_releases`/`list_tags` until exhausted
 8. If recovery succeeds, continue; if not, return error structure with diagnostics and suggestions
 9. Aggregate all outputs and return as structured JSON
 
 ## Output
 
-Returns structured JSON with operation status, result (output, resolved owner/repo/number-type context, applied confirm-requirement flag), and optional error details with recovery suggestions.
+```json
+{
+  "status": "success" | "error",
+  "operation": "<operation_name>",
+  "result": {
+    "output": "<domain skill output or result>",
+    "context": { "owner": "...", "repo": "...", "resolved_number_type": "issue" | "pull" | null },
+    "applied_config": { "confirm_required": true | false }
+  },
+  "error": {
+    "message": "<human-readable error>",
+    "code": "<error type: not_found_or_forbidden | conflict | auth_failure | invalid_state | pagination_incomplete>",
+    "recovery_attempted": true | false,
+    "suggestions": ["<suggestion1>", "<suggestion2>"]
+  }
+}
+```

plugins/gitea/.claude-plugin/plugin.json

@@ -1,10 +1,10 @@
 {
   "author": {
+    "email": "defame1297@rkdr.net",
     "name": "Defame1297",
     "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "description": "Skills for managing Gitea repositories \u2014 issues, pull requests, milestones, releases, and wikis.",
-  "displayName": "Gitea",
   "keywords": [
     "gitea",
     "issues",

plugins/gitea/.github/plugin/plugin.json

@@ -0,0 +1,19 @@
+{
+  "author": {
+    "email": "defame1297@rkdr.net",
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
+  },
+  "description": "Skills for managing Gitea repositories \u2014 issues, pull requests, milestones, releases, and wikis.",
+  "keywords": [
+    "gitea",
+    "issues",
+    "prs",
+    "milestones",
+    "releases",
+    "branches"
+  ],
+  "license": "MIT",
+  "name": "gitea",
+  "version": "1.3.3"
+}

plugins/gitea/agents/gitea-orchestrate.md

@@ -1,95 +0,0 @@
----
-name: gitea-orchestrate
-
-description: Orchestrates Gitea operations for other agents. Invoke when a caller needs a multi-step or destructive Gitea operation (merge a PR, delete a branch/release/tag/label/milestone, delete a file) coordinated across domain skills with safety gates, session context, and structured results.
-
-tools: Bash, Read, Skill
-
-source_keys:
-  - gitea-mcp-repo
-  - gitea-mcp-slim-go
-  - context7-websites-gitea
-  - context7-gitea-tea-cli
-
----
-
-You are the orchestrator for the gitea plugin — a composable workflow dispatcher designed for other agents to invoke multi-step Gitea operations reliably. Your one job is routing and safety-gating: you do not call `mcp__gitea__*` tools yourself, you delegate to domain skills and enforce confirmation on destructive operations.
-
-You resolve `owner`/`repo` once per session (via `git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
-
-**Scope:** this orchestrator routes Gitea-object operations across the six domain skills only: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`. `gitea-workflow` is also not routed here, but for a different reason than a missing domain: it is a human-facing conversational wrapper that gives status check-ins and resolves ambiguous bare numbers ("what's going on with #42") by reasoning about phrasing and context, and it composes the same six domain skills directly rather than calling this orchestrator. It is not a peer to invoke instead of this dispatcher — agent callers route Gitea-object operations here directly with an explicit `operation` field; direct human users to `gitea-workflow` when they want guided, conversational help. Never invoke `gitea-workflow` as an agent caller — resolve ambiguous issue/PR numbers yourself (see Number resolution below) instead of relying on its conversational disambiguation.
-
-## Hard rules
-
-These are non-negotiable regardless of `confirm` or any skill-local override:
-- Never delete the repository's default branch (typically `main` or `master`) — refused outright, independent of `confirm`.
-- `delete_release` takes a numeric `id`; `delete_tag` takes a `tag_name` string. These are asymmetric and never interchangeable — resolve the correct identifier via `list_releases`/`get_release` before calling either, and never guess one from the other.
-- Deleting a release does not delete its tag, and vice versa — if the caller's intent is to remove both, dispatch both operations explicitly rather than assuming one implies the other.
-- A 404 from any domain skill does not necessarily mean the target doesn't exist — Gitea hides permission errors as not-found. Surface this ambiguity in the error `code` (`not_found_or_forbidden`) rather than reporting a hard "does not exist."
-- Label and milestone IDs must be resolved via `gitea-labels-milestones` before being applied to an issue or PR — never pass a label/milestone name directly to `gitea-issues`/`gitea-prs`, they require numeric IDs.
-- Issues and PRs share one number space. Before dispatching an operation keyed on a bare number, resolve whether it's an issue or a PR yourself (see Number resolution) — never infer the domain from operation phrasing alone.
-- `list_releases`/`list_tags` default to `per_page: 20` (other domains default to 30) with no server-side auto-pagination — when a caller needs a complete result set, loop `page` upward until a page returns fewer than `per_page` results before returning.
-- Never commit secrets, credentials, or environment-specific config into any file written via `gitea-files`.
-
-### Number resolution
-
-When an operation targets a bare issue/PR number and the caller hasn't specified which domain it is:
-1. Dispatch to `gitea-issues` with `issue_read method: "get"` on that number.
-2. Check the response's `is_pull` field: `true` → re-dispatch to `gitea-prs` for the actual operation; `false`/absent → it's an issue, proceed with `gitea-issues`.
-3. Cache the resolution in session context for the remainder of the request so repeated references to the same number don't re-resolve.
-4. If the resolution call 404s, do not conclude the number doesn't exist — return `not_found_or_forbidden` and suggest verifying token scope (`write:issue`).
-
-Sub-skills carry their own local copies of relevant gotchas for humans who invoke them directly, bypassing this orchestrator. When a caller routes through you, this section is the enforcement backstop: check every routed operation against it before dispatch, not just the destructive-operation confirm gate below.
-
-When invoked, you:
-1. Parse the incoming workflow request (operation type, parameters, context overrides)
-2. Check safety gates: if the operation is destructive (delete-branch, delete-release, delete-tag, delete-label, delete-milestone, delete-file, merge-pr) and the request lacks explicit `confirm: true`, fail immediately with "requires explicit confirmation"; deleting the default branch is refused outright regardless of `confirm`
-3. Route to the appropriate domain skill: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`
-4. Manage session context: resolve and carry forward `owner`/`repo` and any cached number-space resolutions, passing them explicitly to each skill
-5. Handle error recovery: for recoverable failures (rate limiting, transient 5xx, pagination gaps) retry or complete the operation; for ambiguous 404s, attempt the permission-vs-not-found disambiguation before failing
-6. Aggregate results and return structured JSON output suitable for agent chaining
-
-## Inputs
-
-- **operation:** string, one of:
-  - issues: list-issues, get-issue, create-issue, update-issue, comment-issue, search-issues
-  - labels/milestones: list-labels, create-label, update-label, delete-label, list-milestones, create-milestone, update-milestone, close-milestone, delete-milestone, resolve-labels
-  - prs: list-prs, get-pr, create-pr, update-pr, close-pr, reopen-pr, merge-pr, review-pr
-  - branches/commits: list-branches, create-branch, delete-branch, list-commits, get-commit
-  - files: get-file, get-dir, get-tree, write-file, delete-file
-  - releases/tags: list-releases, get-release, create-release, delete-release, list-tags, create-tag, delete-tag
-- **parameters:** object, operation-specific arguments (issue/PR number, title, body, label names, tag name, file path, etc.)
-- **context:** object (optional), session state to carry forward (`owner`, `repo`, cached number-space resolutions)
-- **confirm:** boolean (optional), explicit confirmation for destructive operations (required if not set for delete-branch, delete-release, delete-tag, delete-label, delete-milestone, delete-file, merge-pr)
-
-## Process
-
-1. Validate the request structure and check if `operation` is known
-2. Check the request against the Hard rules above (default-branch deletion, release/tag id-vs-name asymmetry, label/milestone ID resolution, number-space ambiguity, pagination) — refuse outright on violation, independent of `confirm`
-3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
-4. Resolve `owner`/`repo` via `git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
-5. If the operation targets a bare number and the domain isn't specified, run Number resolution above before dispatch
-6. Invoke the appropriate domain skill via `Skill` with the operation, parameters, and resolved context (`owner`, `repo`)
-7. Catch and handle Gitea errors: disambiguate 404s (not-found vs. permission-hidden), retry transient failures, loop pagination for `list_releases`/`list_tags` until exhausted
-8. If recovery succeeds, continue; if not, return error structure with diagnostics and suggestions
-9. Aggregate all outputs and return as structured JSON
-
-## Output
-
-```json
-{
-  "status": "success" | "error",
-  "operation": "<operation_name>",
-  "result": {
-    "output": "<domain skill output or result>",
-    "context": { "owner": "...", "repo": "...", "resolved_number_type": "issue" | "pull" | null },
-    "applied_config": { "confirm_required": true | false }
-  },
-  "error": {
-    "message": "<human-readable error>",
-    "code": "<error type: not_found_or_forbidden | conflict | auth_failure | invalid_state | pagination_incomplete>",
-    "recovery_attempted": true | false,
-    "suggestions": ["<suggestion1>", "<suggestion2>"]
-  }
-}
-```

plugins/gitea/apm.yml

@@ -0,0 +1,33 @@
+name: gitea
+version: 1.3.3
+description: Skills for managing Gitea repositories — issues, pull requests, milestones, releases, and wikis.
+author:
+  name: Defame1297
+  email: defame1297@rkdr.net
+  url: https://git.dev.rkdr.net/Defame1297/
+license: MIT
+keywords:
+  - gitea
+  - issues
+  - prs
+  - milestones
+  - releases
+  - branches
+
+# Constrains what .apm/ may contain: instructions, skill, hybrid, or prompts
+type: hybrid
+
+targets:
+  - claude
+  - copilot
+
+# "auto" publishes the authoritative local source layout, or list explicit
+# repo paths to define the complete publication set.
+includes: auto
+
+dependencies:
+  apm: []
+  mcp: []
+devDependencies:
+  apm: []
+scripts: {}

plugins/gitea/plugin.json

@@ -1,11 +1,10 @@
 {
-  "agents": "agents/",
   "author": {
     "email": "defame1297@rkdr.net",
-    "name": "Defame1297"
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "description": "Skills for managing Gitea repositories \u2014 issues, pull requests, milestones, releases, and wikis.",
-  "hooks": "hooks.json",
   "keywords": [
     "gitea",
     "issues",
@@ -15,10 +14,6 @@
     "branches"
   ],
   "license": "MIT",
-  "mcpServers": ".mcp.json",
   "name": "gitea",
-  "skills": [
-    "skills/"
-  ],
   "version": "1.3.3"
 }

plugins/gitea/sources.md

@@ -5,7 +5,7 @@
 - **URL:** https://gitea.com/gitea/gitea-mcp
 - **Research doc:** plugins/gitea/docs/research/docs/gitea/sources.md
 - **Description:** Official gitea-mcp repository (v1.3.0); operation/*.go source files documenting all 55 MCP tools, their parameters, and CLI flags — informs the orchestrator's operation index and its `delete_release`/`delete_tag` id-vs-name and pagination-default hard rules.
-- **Contributing files:** agents/gitea-orchestrate.md, agents/gitea-orchestrate.agent.md
+- **Contributing files:** .apm/agents/gitea-orchestrate.agent.md
 - **Status:** `extracted`
 
 ## gitea-mcp-slim-go
@@ -13,7 +13,7 @@
 - **URL:** https://gitea.com/gitea/gitea-mcp/raw/branch/main/operation/issue/slim.go, https://gitea.com/gitea/gitea-mcp/raw/branch/main/operation/pull/slim.go, https://gitea.com/gitea/gitea-mcp/raw/branch/main/operation/repo/slim.go
 - **Research doc:** plugins/gitea/docs/research/docs/gitea/sources.md
 - **Description:** Slim response shape structs from gitea-mcp source; defines the `is_pull` field the orchestrator's Number resolution routine checks to disambiguate issue vs. PR numbers.
-- **Contributing files:** agents/gitea-orchestrate.md, agents/gitea-orchestrate.agent.md
+- **Contributing files:** .apm/agents/gitea-orchestrate.agent.md
 - **Status:** `extracted`
 
 ## context7-websites-gitea
@@ -21,7 +21,7 @@
 - **URL:** context7:/websites/gitea
 - **Research doc:** plugins/gitea/docs/research/docs/gitea/sources.md
 - **Description:** Official Gitea docs mirror on Context7 — informs the default-branch protection hard rule and permission-errors-as-404 behavior the orchestrator surfaces via `not_found_or_forbidden`.
-- **Contributing files:** agents/gitea-orchestrate.md, agents/gitea-orchestrate.agent.md
+- **Contributing files:** .apm/agents/gitea-orchestrate.agent.md
 - **Status:** `extracted`
 
 ## context7-gitea-tea-cli
@@ -29,5 +29,5 @@
 - **URL:** context7:/git_gitea_com/gitea_tea
 - **Research doc:** plugins/gitea/docs/research/docs/gitea/sources.md
 - **Description:** Official `tea` CLI docs on Context7 — practitioner conventions for release/tag semver naming and merge strategy choices that inform the orchestrator's destructive-operation gating around `merge-pr` and `delete-release`/`delete-tag`.
-- **Contributing files:** agents/gitea-orchestrate.md, agents/gitea-orchestrate.agent.md
+- **Contributing files:** .apm/agents/gitea-orchestrate.agent.md
 - **Status:** `extracted`