fix(kyberforge): resolve PR #144 review and audit round 2

- factory-audit: ./ and bare/absolute script checks scoped to command
  position (no false FAILs on ./src or printf); hook sources limited to
  .apm/hooks or package-root hooks/; Kiro-aware lowercase events;
  unfilled template placeholders FAIL; repo-only instructions FAIL at
  any scope; Vale description FAIL documented; bats 367 -> 378
- primitive-author: split-quote/spaced paths and handler-less entries
  promoted to Must; Step 4.2 renders into a scratch consumer instead of
  a no-op dry run; dispatch and gate hand-off trimmed
- apm-workflow 1.0.2: mutual boundary with primitive-author
- forge: no double package bump; gotcha wording
- skill-author: create keeps seeded 0.1.0 (ADR-0022); portable,
  retry-safe new-skill.sh; template and flow consistency fixes
- hook docs: cite the ADR-0019 correction; guard caveat

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/docs/hooks.md

@@ -87,7 +87,8 @@ ADR-0019.
 
 **Claude Code only, and where it looks for the lockfile.** The hook exits 0 at once, silently and
 without calling `apm`, unless `CLAUDE_PROJECT_DIR` is set and non-empty — Claude Code exports it for
-SessionStart hooks, and that guard is what keeps the hook inert under Copilot and Codex (see below).
+SessionStart hooks, and Copilot and Codex do not document setting it, so the guard keeps the hook
+inert there unless the variable is inherited from the user's environment (see below).
 It then takes `${CLAUDE_PROJECT_DIR}` as the project directory and exits silently unless that
 directory holds an `apm.lock.yaml` — which is what makes it inert in any project that does not
 consume packages through apm. Both `apm` invocations run against the same directory. The earlier