fix(kyberforge): broaden audit self-triggers, plug factory gaps

skill-audit/agent-audit now proactively trigger after a skill/agent
file is hand-edited outside skill-author/agent-author, not just on
explicit request — closing a gap from this session where a fork's
direct edits to agent-author/agent-audit shipped without their own
inline audit until forge was invoked to check afterward.

Also: plugin-author gains a gotcha on claude plugin validate --strict
auto-discovering every .md under agents/ regardless of manifest
declarations (ADR-0010); agent-audit's dimension count and
validate-provenance.sh's --help now match actual behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plugins/kyberforge/skills/agent-audit/scripts/validate-provenance.sh

@@ -14,6 +14,7 @@ Arguments:
 Exit codes:
   0  All checks passed (or nothing to validate, or not plugin scope)
   1  One or more checks failed
+  2  Script error (unrecognized file extension — expected .md or .agent.md)
 
 Checks performed:
   0  source_keys present in agent pair but sources.md absent