fix(kyberforge): announce every provenance skip and scope checks 7-8 to source indexes

The clean provenance bill was an artifact. Checks 7 and 8 assume `Research doc:`
names a source index whose H2s are slugs, but 30 of 121 corpus entries point at
topic content documents whose H2s are topics. Those 30 produced every new check-7
INFO — all false positives. Check 8 aimed at the same documents, which carry no
`Status:` line at all, would have emitted a large false-FAIL flood; the only thing
preventing it was an unannounced `rd_status != extracted` skip. So "0 new FAILs"
rested on exactly the fail-open class this branch exists to remove, and naively
fixing the skip would have turned the branch red.

Checks 7/8 now run only when the research doc's basename is `sources.md`, and every
other case emits a visible INFO naming the slug. The dangling-path INFO stays ahead
of the basename gate, because a path that does not resolve is rot whatever it is
named. `parse_status` accepts the bullet form and a trailing note after the
backticked value, so a status it cannot read no longer reads as "nothing to check".

Corpus: 36 INFOs of which 30 were false, to 56 of which none are. FAIL stays 0, and
no Status line flipped to `extracted` under the new parser, so no FAIL was
suppressed by luck.

Also closed, each a silent pass: a nonexistent directory, a directory with no
SKILL.md, and extra arguments now exit 2; a UTF-8 BOM no longer defeats frontmatter
parsing; the bare `except Exception: return False` that turned an unreadable file
into a clean pass is gone, with all reads pinned to UTF-8; check 3 walks nested
`references/` subdirectories; `FILL IN:` at end of line no longer escapes checks 1
and 6; duplicate `## slug` blocks and repeated `Research doc:` lines are announced
rather than half-read.

The agent-audit copy carried all of the above unfixed and is now ported, minus the
four fixes that are genuinely N/A at agent scope — it reads a plugin-root
`sources.md` and has no checks 7/8 and no `references/` tree. Its silent exit 0 for
a file outside plugin scope is preserved deliberately: that is a verdict about a
valid file, not a skip, and `check-scope-walkup-sync.sh` pins it. Every exit-2 gate
therefore decides from the argument alone, before the walk-up runs.

`validation-scripts.md` said flatly that silence from the validator is a pass, not
a skip. That sentence is what made a typo'd path dangerous, and both copies are
corrected here. The matching SKILL.md exit-code guidance lands with the audit
rubric change, which touches the same files.

Tests: skill-audit 45 to 65, agent-audit 24 to 43, every new case proven by mutation.

Refs: #111, #118, #121

plugins/kyberforge/.apm/skills/skill-audit/references/validation-scripts.md

@@ -99,9 +99,12 @@ Three ways to read the result wrong:
 
 ## Script-specific failures
 
-- **`validate-provenance.sh` printed nothing.** That is a pass, not a skip. It also exits 0
-  silently when the skill has no `source_keys` and no `references/sources.md` — nothing to
-  validate is not a finding.
+- **`validate-provenance.sh` printed nothing *and exited 0*.** That is a pass, not a skip — it
+  exits 0 silently when the skill has no `source_keys` and no `references/sources.md`, and nothing
+  to validate is not a finding. Check the exit code before you believe the silence: a target that
+  is not a directory, a directory holding no `SKILL.md`, a missing or extra argument, and an absent
+  `python3` all exit **2** with a message on stderr. Exit 2 means the script never ran — report it
+  as an unaudited dimension, never as a pass and never as a finding. Exit 1 is findings.
 - **`vale` reports `0 files`.** Treat the pass as NOT RUN, not as clean, and fall back to full
   Step 3 judgment for the dimensions it would have covered. The bundled `Kyberforge` style is
   scoped by glob in `assets/vale/.vale.ini`; a file outside those globs is silently not linted.