fix(kyberforge): give branch-aware advice for the refreshed apm lock

Why: the docs said to discard a refreshed apm.lock.yaml on a feature
branch because the refresh records main's commit, but the branch's own
lock records a (older) main commit too, and the SessionStart notice gave
the same "commit or discard" advice on every branch.

Implementation Notes:
- check-apm-current.sh picks fixed advice by branch: commit or discard
  deliberately on the default branch (origin/HEAD, else main), discard and
  reinstall on a feature branch; the branch name is never interpolated.
- README, AGENTS.md and ADR-0019 give the real reasons (no lock churn in
  the branch diff, deployed tree matches the committed lock), the cost
  (the session runs the older main) and that the next session start
  refreshes again.
- ADR-0019's check-clean and stale-server claims restated to match apm's
  source.

ADR: 0019
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kyberforge/.apm/hooks/check-apm-current.sh

@@ -51,8 +51,25 @@ emit() {
   printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","reloadSkills":%s,"additionalContext":"%s"}}\n' "$1" "$2"
 }
 
+# What to do with the rewritten lock depends on the branch (ADR-0019): on the
+# default branch it is a real update to commit or discard; on a feature branch it
+# is churn unrelated to the branch and should be discarded. The branch name only
+# selects between fixed strings and is never interpolated. Outside a git checkout,
+# or on a detached HEAD, the neutral advice stands.
+lock_advice="commit it or discard it deliberately."
+current_branch="$(git symbolic-ref --short -q HEAD 2> /dev/null || true)"
+if [[ -n "$current_branch" ]]; then
+  default_branch="$(git symbolic-ref --short -q refs/remotes/origin/HEAD 2> /dev/null || true)"
+  default_branch="${default_branch#origin/}"
+  if [[ "$current_branch" == "${default_branch:-main}" ]]; then
+    lock_advice="this is the default branch, so commit it or discard it deliberately."
+  else
+    lock_advice="this is a feature branch, so discard it: git checkout -- apm.lock.yaml && apm install"
+  fi
+fi
+
 if timeout 300 apm update --yes > /dev/null 2>&1; then
-  emit true "apm install was ${stale_count} package(s) behind the remote default branch and has been refreshed automatically; skills and agents were redeployed and re-scanned. apm.lock.yaml has been rewritten and is now a modified file in the working tree - commit it or discard it deliberately."
+  emit true "apm install was ${stale_count} package(s) behind the remote default branch and has been refreshed automatically; skills and agents were redeployed and re-scanned. apm.lock.yaml has been rewritten and is now a modified file in the working tree - ${lock_advice}"
 else
   emit false "apm install is ${stale_count} package(s) behind the remote default branch and the automatic refresh failed. Deployed skills and agents may be stale. Run: apm update --yes"
 fi