fix(factory-audit): flag unbraced plugin-root tokens and close hook check gaps

Why: PR #144 review round 4 reproduced hooks referencing $PLUGIN_ROOT or
${PLUGIN_ROOT} without a path separator passing the audit, although apm
only rewrites ${TOKEN}/ and the deployed hook points nowhere.

- FAIL unbraced or unseparated plugin-root tokens
- check the exec bit for scripts run via an interpreter -c string
- skip env NAME=value prefixes when locating bare relative paths
- correct input: and empty-frontmatter messages, depth-walk applyTo braces
- INFO on unrecognised targets; failing-case tests for untested checks
- document tiers, blind spots and crash exit 2; drop rtk from portable flow
- restore the after-a-hand-edit trigger; pin upstream apm source URL

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/factory-audit/assets/vale/.vale.ini

@@ -12,7 +12,7 @@ BasedOnStyles = Kyberforge
 [**/*.prompt.md]
 BasedOnStyles = Kyberforge
 
-# Stays the last section: tests/test-vale-wrap.sh case 31 appends a rule
+# Stays the last section: the repo's `tests/test-vale-wrap.sh` case 31 appends a rule
 # override to the end of this file and relies on it landing here.
 [**/*.agent.md]
 BasedOnStyles = Kyberforge, KyberforgeCopilot

plugins/kyberforge/.apm/skills/factory-audit/assets/vale/styles/Kyberforge/PaddingPhrase.yml

@@ -1,5 +1,5 @@
 extends: existence
-message: "Generic reference pointer: '%s' — use the specific 'If X, read `references/file.md`' form instead"
+message: "Generic reference pointer: '%s' — name the exact file and when to read it ('If X, read `<path>`') instead"
 level: error
 scope: text
 ignorecase: true