fix(kyberforge): resolve clean-context audit findings on primitive support

primitive-author:
- description excludes read-only review (-> factory-audit)
- validation Gotcha now matches the research: compile never reads
  prompts, install fails only on a bad Copilot hook payload and warns on
  prompt input names and dropped keys
- instruction fold-in into AGENTS.md/CLAUDE.md stated as conditional on
  dedup and --force-instructions
- hook checklist gains the wrapped-shape Must, drops hardlinks, notes
  why executable is stricter than the research, and states the
  separate Copilot-targeted package route instead of a blanket "don't"
- prompt Must 5 keeps the research's Copilot-only-key exception; adds
  model-slug and 250-char Shoulds; descriptions name skills or agents
- placeholder instruction covers both FILL IN and FILL_IN_ tokens

factory-audit: hardlink FAIL scoped to instructions and prompts
(find_hook_files skips symlinks only), with bats cases; prompt-flow
description rubric names skills or agents.

forge: version-bump, apm-routes and sources references updated for the
primitive route.

Refs #94

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/forge/references/apm-routes.md

@@ -21,7 +21,7 @@ checkpoints to the user in real time.
 
 ## No clean-context recheck, and no automatic audit
 
-Skill and agent routes close with a clean-context audit rerun; these two do not, and the omission
+Skill, agent and primitive routes close with a clean-context audit rerun; these two do not, and the omission
 is deliberate rather than an oversight. Neither artifact type has an audit skill counterpart to
 re-run, so detaching the route to earn a recheck it would never get buys nothing.
 

plugins/kyberforge/.apm/skills/forge/references/sources.md

@@ -28,7 +28,7 @@
 
 - **URL:** https://agentskills.io/specification.md
 - **Research doc:** plugins/kyberforge/docs/research/docs/agentskillsio/sources.md
-- **Description:** Complete SKILL.md format specification — confirms `assets/`, `references/`, and `scripts/` are warranted only by the bulk/reusability of supporting content (large reference material, executable code, templates), not by a skill's category, and forge's per-route procedures are that kind of supporting content — so the spec permits the `references/` split here but does not require it. The warrant is a house decision: dispatch is mandatory at two or more mutually exclusive flows, which forge's four-row table is. `references/sources.md` likewise exists for this repo's own provenance-chain convention (see `CONTEXT.md`), not because the spec requires it.
+- **Description:** Complete SKILL.md format specification — confirms `assets/`, `references/`, and `scripts/` are warranted only by the bulk/reusability of supporting content (large reference material, executable code, templates), not by a skill's category, and forge's per-route procedures are that kind of supporting content — so the spec permits the `references/` split here but does not require it. The warrant is a house decision: dispatch is mandatory at two or more mutually exclusive flows, which forge's five-row table is. `references/sources.md` likewise exists for this repo's own provenance-chain convention (see `CONTEXT.md`), not because the spec requires it.
 - **Contributing files:** SKILL.md
 - **Status:** `extracted`
 

plugins/kyberforge/.apm/skills/forge/references/version-bump.md

@@ -7,8 +7,9 @@ source_keys:
 
 Reached from `SKILL.md` Step 3 after a route has finished. A skill route always lands here:
 `skill-author` moves only a skill's own `metadata.version`, which is not the package manifest's
-number, so the package version is still behind when it reports done. `agent-author` bumps the
-resolved package's `apm.yml` itself at plugin/APM scope, and `apm-workflow`'s configure flow
+number, so the package version is still behind when it reports done. `agent-author` and
+`primitive-author` bump the resolved package's `apm.yml` themselves at plugin/APM scope, and
+`apm-workflow`'s configure flow
 carries the same policy — read those routes' output before acting here, because a second bump for
 one change is wrong.