fix(kyberforge): resolve PR #144 review and audit round 2

- factory-audit: ./ and bare/absolute script checks scoped to command
  position (no false FAILs on ./src or printf); hook sources limited to
  .apm/hooks or package-root hooks/; Kiro-aware lowercase events;
  unfilled template placeholders FAIL; repo-only instructions FAIL at
  any scope; Vale description FAIL documented; bats 367 -> 378
- primitive-author: split-quote/spaced paths and handler-less entries
  promoted to Must; Step 4.2 renders into a scratch consumer instead of
  a no-op dry run; dispatch and gate hand-off trimmed
- apm-workflow 1.0.2: mutual boundary with primitive-author
- forge: no double package bump; gotcha wording
- skill-author: create keeps seeded 0.1.0 (ADR-0022); portable,
  retry-safe new-skill.sh; template and flow consistency fixes
- hook docs: cite the ADR-0019 correction; guard caveat

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/skill-author/references/improve.md

@@ -10,13 +10,9 @@ source_keys:
 Return to `SKILL.md` Step 4 once Step 4 below is done — validation, versioning and commit
 verification are shared with the create flow and are not repeated here.
 
-## Step 1 — Verify inputs
+## Step 1 — Signal sources
 
-Confirm the skill directory path exists and that at least one improvement signal is present in the
-conversation or a referenced file.
-
-If the skill directory is missing, ask for it. If no signals are present, stop: "This skill applies
-existing signals to a skill. For a blind review without signals, use `/factory-audit` instead."
+The dispatch in `SKILL.md` Step 1 has already confirmed the directory and at least one signal.
 
 Signals can come from anywhere in the conversation or referenced files:
 
@@ -25,8 +21,6 @@ Signals can come from anywhere in the conversation or referenced files:
 - Human feedback (feedback.json, inline in conversation, PR or issue comments)
 - Session context describing what went wrong
 
-Also verify the `name` field in frontmatter matches the skill's directory name exactly.
-
 ## Step 2 — Gather and group signals
 
 Read the current skill files (SKILL.md and any files in `scripts/`, `references/`, `assets/`,
@@ -102,6 +96,9 @@ exactly one flow reaches it, otherwise in the body's common-gates section.
 If a signal points to a script or reference file, edit that file directly rather than adding a
 workaround in SKILL.md.
 
+**Do not create a new script unless a signal explicitly calls for it.** Writing one from scratch
+requires out-of-scope transcript analysis — flag the opportunity as a suggestion instead.
+
 **A skill carrying no `metadata.version` is seeded at `"1.0.0"`, not bumped** — `SKILL.md` Step 4's
 patch bump presumes a version to bump, and ADR-0022 reserves `"0.1.0"` for a newly created skill.