fix(kyberforge): resolve clean-context audit findings on primitive support

primitive-author:
- description excludes read-only review (-> factory-audit)
- validation Gotcha now matches the research: compile never reads
  prompts, install fails only on a bad Copilot hook payload and warns on
  prompt input names and dropped keys
- instruction fold-in into AGENTS.md/CLAUDE.md stated as conditional on
  dedup and --force-instructions
- hook checklist gains the wrapped-shape Must, drops hardlinks, notes
  why executable is stricter than the research, and states the
  separate Copilot-targeted package route instead of a blanket "don't"
- prompt Must 5 keeps the research's Copilot-only-key exception; adds
  model-slug and 250-char Shoulds; descriptions name skills or agents
- placeholder instruction covers both FILL IN and FILL_IN_ tokens

factory-audit: hardlink FAIL scoped to instructions and prompts
(find_hook_files skips symlinks only), with bats cases; prompt-flow
description rubric names skills or agents.

forge: version-bump, apm-routes and sources references updated for the
primitive route.

Refs #94

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/primitive-author/references/instruction.md

@@ -17,8 +17,9 @@ glob. On Claude it deploys to `.claude/rules/<stem>.md` with `applyTo` renamed t
 - **A rule for this repo alone** → it belongs in the repo's AGENTS.md, which is the single
   always-on source. Stop and hand to `agentsmd-author`.
 - **No file pattern fits** → an instruction without `applyTo` is always-on in every session of
-  every repo that installs this package, and `apm compile` folds it into the global sections of
-  `AGENTS.md` and `CLAUDE.md`. Say exactly that to the user and continue only on an explicit yes.
+  every repo that installs this package, and `apm compile` can fold it into the global sections of
+  `AGENTS.md` and `CLAUDE.md` (skipped when `.github/instructions/` or `.claude/rules/` is already
+  populated, unless `--force-instructions`). Say exactly that to the user and continue only on an explicit yes.
   Legitimate when a package deliberately ships guidance to its consumers; never a default.
 - **Procedure the agent follows step by step** → a skill. Stop and hand to `skill-author`.
 - **A rule scoped to a file pattern** → continue.
@@ -32,7 +33,7 @@ Must:
 1. The path is `.apm/instructions/<stem>.instructions.md`, directly in that directory, not a
    symlink or hardlink.
 2. `description` is a non-empty string. apm only warns when it is missing.
-3. The body is non-empty. apm deploys an empty rule silently.
+3. The body is non-empty after trimming whitespace. apm deploys an empty rule silently.
 4. `applyTo` is a non-empty glob or comma-separated list — top-level commas only as separators,
    alternation inside `{}` (`"**/*.{ts,tsx}"`) — or absent after the Gate's explicit yes.
 5. The stem is unique across the package and its dependencies: a `.claude/rules/<stem>.md`