feat(kyberforge): add agent-audit skill (closes #11)

## Why

agent-author produces paired agent definition files (Claude Code .md +
Copilot .agent.md) but had no companion audit skill to validate them.
agent-audit fills that gap, giving the same structured PASS/FAIL report
that skill-audit provides for SKILL.md files.

## Implementation Notes

- validate.sh uses scope detection (walk up for plugin.json / .git) to
  locate the counterpart file and determine whether plugin-silently-ignored
  fields (hooks, mcpServers, permissionMode) should be flagged
- CC-only and silently-ignored field lists are read from
  references/field-inventory.md at runtime rather than hardcoded —
  provenance back to the research corpus; see ADR-0019
- Single-file invocation (pass either file, counterpart derived) chosen
  over directory or name+root — see ADR-0018
- 12 bats tests cover provider detection, scope detection, all FAIL paths,
  and clean-pair pass

## Impact

- kyberforge bumped to v1.1.2
- agent-author close step should be updated to reference agent-audit (#11)
- Provenance/sources chain check deferred to #60

ADR: docs/adr/0018-agent-audit-single-file-invocation.md
ADR: docs/adr/0019-agent-audit-field-inventory-reference.md
Refs: #11
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147vXtL5sP6vorDdqXGJJU9

docs/adr/0019-agent-audit-field-inventory-reference.md

@@ -0,0 +1,30 @@
+# agent-audit reads field lists from a reference file, not hardcoded script arrays
+
+`agent-audit`'s `validate.sh` checks for Claude Code-only fields in Copilot files and
+silently-ignored fields in plugin agents. Rather than hardcoding those field lists in the
+script, the script reads `references/field-inventory.md` at runtime. This keeps field list
+maintenance decoupled from script logic and preserves a provenance chain back to the
+research corpus that sourced the lists.
+
+## Considered options
+
+**Hardcode in validate.sh (rejected)** — field lists live as literal arrays in the
+bash/python script. Rejected because: (1) the lists came from research docs
+(`claude-code-plugins/agent-definition.md` and `github-copilot-plugins/agent-definition.md`)
+and should maintain a provenance chain back to those sources via `source_keys` frontmatter;
+(2) both provider APIs evolve — updating a structured markdown file is lower friction than
+editing a script and less likely to introduce bugs; (3) it breaks the bidirectional reference
+principle already established for this repo, where research-derived content carries explicit
+source attribution.
+
+## Consequences
+
+- `validate.sh` must parse `references/field-inventory.md` to extract field lists — the
+  file format must be machine-parseable (section headings the script can grep, or a simple
+  list structure).
+- `field-inventory.md` carries `source_keys` frontmatter referencing
+  `claude-code-plugins-docs` and `github-custom-agents-configuration` slugs.
+- The script exits with a clear error if `references/field-inventory.md` is not found —
+  fail-fast, not silent.
+- Field list updates (new provider field, deprecated field) require only editing
+  `field-inventory.md`; no script change needed.