fix(agents): relocate provenance sources.md outside agents/ dir

`claude plugin validate --strict` auto-discovers every .md under a
plugin's agents/ directory as an agent requiring frontmatter, so the
provenance file there always needs fake agent frontmatter to pass
validation. Confirmed empirically that an explicit `agents` manifest
array can't suppress this discovery. Move the file to <plugin-root>/
sources.md instead, and update agent-author/agent-audit accordingly.

Adds ADR-0010, partially superseding ADR-0005's `agents/sources.md`
convention. Fixes #63.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plugins/git/plugin.json

@@ -18,5 +18,5 @@
   "skills": [
     "skills/"
   ],
-  "version": "1.3.1"
+  "version": "1.3.2"
 }