fix(kyberforge): broaden audit self-triggers, plug factory gaps

skill-audit/agent-audit now proactively trigger after a skill/agent
file is hand-edited outside skill-author/agent-author, not just on
explicit request — closing a gap from this session where a fork's
direct edits to agent-author/agent-audit shipped without their own
inline audit until forge was invoked to check afterward.

Also: plugin-author gains a gotcha on claude plugin validate --strict
auto-discovering every .md under agents/ regardless of manifest
declarations (ADR-0010); agent-audit's dimension count and
validate-provenance.sh's --help now match actual behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plugins/kyberforge/skills/skill-audit/SKILL.md

@@ -4,6 +4,8 @@ description: >
   Use when the user wants to review a skill they wrote, says "audit this skill",
   "check if my skill follows best practices", "review my SKILL.md", or wants to
   know if a skill is ready to ship — even if they don't use the word "audit".
+  Also invoke proactively after directly hand-editing a skill's files outside
+  skill-author — an unaudited hand-edit is the same risk as unreviewed code.
   Audits a skill directory against the agentskills.io specification — structural
   checks plus qualitative review of description quality, body discipline, patterns,
   formatting, file structure, scripts, and internal consistency, plus a provenance