fix(kyberforge): resolve PR #144 review and audit round 2

- factory-audit: ./ and bare/absolute script checks scoped to command
  position (no false FAILs on ./src or printf); hook sources limited to
  .apm/hooks or package-root hooks/; Kiro-aware lowercase events;
  unfilled template placeholders FAIL; repo-only instructions FAIL at
  any scope; Vale description FAIL documented; bats 367 -> 378
- primitive-author: split-quote/spaced paths and handler-less entries
  promoted to Must; Step 4.2 renders into a scratch consumer instead of
  a no-op dry run; dispatch and gate hand-off trimmed
- apm-workflow 1.0.2: mutual boundary with primitive-author
- forge: no double package bump; gotcha wording
- skill-author: create keeps seeded 0.1.0 (ADR-0022); portable,
  retry-safe new-skill.sh; template and flow consistency fixes
- hook docs: cite the ADR-0019 correction; guard caveat

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/skill-author/assets/templates/SKILL.md

@@ -16,14 +16,12 @@ description: >
   Not FILL IN: near-miss case -> FILL IN: real sibling skill.
 # Required. Preloaded into EVERY session whether or not the skill is invoked.
 # Exactly three parts, in this order: trigger clause, at most one capability
-# clause, boundary clause. Drop the boundary line if no near-miss skill exists.
+# clause, boundary clause. Write one boundary clause per genuine near-miss; at least one.
 # Trigger clause: when should an agent activate this skill? Describe the user's
 # intent, not the skill's internal mechanics.
 # Budget: 250 characters target, 400 hard ceiling (counting this value only,
-# with YAML folding resolved). This scaffold sits at 214 — keep the fill-in
-# under the target rather than growing past it.
-# Boundary clauses may be plural: write one per genuine near-miss, and none
-# where no sibling could steal activations.
+# with YAML folding resolved). Keep the fill-in under the target rather
+# than growing past it.
 # Never let a hyphenated skill name wrap across two lines of this folded block
 # — folding turns the break into a space and the routing target stops resolving.
 # Banned here: capability lists, output-format detail, composition notes,
@@ -89,7 +87,7 @@ metadata:
      after the mistake is worthless.
 
      Each entry states a fact that CONTRADICTS a reasonable default:
-     something the agent gets wrong by acting sensibly. Maximum 5 entries.
+     something the agent gets wrong by acting sensibly. Aim for at most five; more is a SUGGESTION.
      An entry that paraphrases a step below it is a failure, not a gotcha.
 
 ## Gotchas

plugins/kyberforge/.apm/skills/skill-author/assets/templates/references/sources.md

@@ -1,6 +1,6 @@
 # Sources
 
-<!-- Populated at Step 5 of skill authoring, after all skill files are written.
+<!-- Populated at Step 6 of skill authoring (`references/create.md`), after all skill files are written.
      For each research source with status `extracted`, record which skill files
      it contributed to under Contributing files.
      Delete this file if no research sources were provided as input. -->