fix(agents): relocate provenance sources.md outside agents/ dir

`claude plugin validate --strict` auto-discovers every .md under a
plugin's agents/ directory as an agent requiring frontmatter, so the
provenance file there always needs fake agent frontmatter to pass
validation. Confirmed empirically that an explicit `agents` manifest
array can't suppress this discovery. Move the file to <plugin-root>/
sources.md instead, and update agent-author/agent-audit accordingly.

Adds ADR-0010, partially superseding ADR-0005's `agents/sources.md`
convention. Fixes #63.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plugins/kyberforge/skills/agent-author/tests/new-agent.bats

@@ -42,11 +42,11 @@ teardown() {
     assert [ -d "$ROOT/agents" ]
 }
 
-@test "plugin scope: creates sources.md in agents/" {
+@test "plugin scope: creates sources.md at plugin root" {
     touch "$ROOT/plugin.json"
     run bash "$SCRIPT" my-agent "$ROOT"
     assert_success
-    assert [ -f "$ROOT/agents/sources.md" ]
+    assert [ -f "$ROOT/sources.md" ]
 }
 
 @test "plugin scope: no-op if claude code file already exists" {