chore(apm): regenerate compiled manifests and content mirrors

Output of apm pack, sync-plugin-content.sh --all and
sync-marketplace-mirror.sh against this round's source changes. No file here
is hand-edited.

Carries the version bumps and marketplace owner.email into the compiled
manifests, the disallowedTools frontmatter and doc corrections into the flat
mirrors, and changes plugins/bin/.github/plugin/plugin.json's mcpServers from
the inlined server object to the ".mcp.json" pointer. That last file also
returns to 0644: the previous re-injection wrote it through mktemp and carried
0600 across, which no gate could see because the mode check did not cover
.github/plugin/ and git tracks only the exec bit.

.agents/plugins/marketplace.json is unchanged and that is correct -- apm's
codex profile carries neither version nor owner keys, so nothing in this round
reaches it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

plugins/kyberforge/skills/agent-audit/scripts/validate.sh

@@ -241,10 +241,13 @@ def check_apm_agent_file(fpath, allowlist, stem):
         fail(f"frontmatter still contains template HTML comments (<!-- ... -->) "
              f"— delete them before shipping — {local_fname}")
 
-    # Allowlist: only name/description/model may appear — no tools, no
-    # Claude-only or Copilot-only fields. apm compile verbatim-copies
-    # frontmatter to every target, so anything else is unsafe on at least
-    # one harness (ADR-0016).
+    # Allowlist: the permitted keys are data, read at load time from
+    # references/field-inventory.md's `## apm-agent-allowlist` section — do not
+    # restate them here, or this comment goes stale the next time that line
+    # changes. apm compile verbatim-copies frontmatter to every target, so a key
+    # outside the list is unsafe on at least one harness (ADR-0016). Note the
+    # list admits denylist-shaped restrictions (disallowedTools) but never
+    # allowlist-shaped ones (tools), whose value shape differs per harness.
     fm_keys = get_frontmatter_keys(fm)
     for key in sorted(fm_keys):
         if key not in allowlist: