fix(kyberforge): surface commit-hash checklist earlier, drop redundant scripts line in skill-author

Independent /skill-audit recheck flagged the git-log-capture instructions
as discoverable only at close-out (Step 6/Step 5), long after the step
where the hash should actually be snapshotted. Adds the capture checklist
item to Prerequisites (create flow) and Step 1 (improve flow) instead of
leaving it as a retrospective-only note. Also drops a sentence in the
improve flow's Step 4 that duplicated the preceding one on editing
scripts/reference files directly.

Refs #69

plugins/kyberforge/skills/skill-author/SKILL.md

@@ -51,6 +51,7 @@ Design for one coherent user intent — skills too narrow force multiple loads p
 - [ ] A clear purpose — what specific task will this skill handle?
 - [ ] Trigger scenarios — when should an agent activate it, including indirect cases?
 - [ ] Skill name (kebab-case) and destination path
+- [ ] Capture `git log --oneline -1` now, before touching the filesystem — Step 6 needs it to verify a real commit landed
 
 If any are missing, stop and ask the user before proceeding.
 
@@ -233,6 +234,8 @@ Confirm the skill directory path exists and that at least one improvement signal
 
 If the skill dir is missing, ask for it. If no signals are present, stop: "This skill applies existing signals to a skill. For a blind review without signals, use `/skill-audit` instead."
 
+- [ ] Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed
+
 Signals can come from anywhere in the conversation or referenced files:
 - Grill session output (most common predecessor in the factory sequence)
 - `/skill-audit` findings (PASS/FAIL/SUGGESTION punch list)
@@ -275,8 +278,6 @@ Edit any file in the skill directory that the signals point to: SKILL.md, script
 
 If a signal points to a script or reference file, edit that file directly rather than adding a workaround in SKILL.md.
 
-**On scripts**: Fix and edit existing scripts freely when signals point to them.
-
 ### Step 5 — Validate and close
 
 Before running the audit, confirm: