fix(kyberforge): require commit-hash verification in agent-author

Prior sessions had authoring subagents report completion after only
staging changes (git diff --stat showing output, but no git commit).
agent-author's create and improve flows now require capturing
git log --oneline -1 before and after the authoring pass and asserting
the hash actually changed via a real commit, matching the fix already
applied to skill-author.

Refs #69

plugins/kyberforge/skills/agent-author/SKILL.md

@@ -56,6 +56,7 @@ Before touching the filesystem, confirm you have:
 - [ ] Root directory (plugin root, project root, or `~` for user scope)
 - [ ] Agent purpose — one sentence describing the task this agent handles
 - [ ] Trigger condition — when should the runtime delegate to this agent?
+- [ ] Capture `git log --oneline -1` now, before touching the filesystem — Step 5 needs it to verify a real commit landed
 
 If any are missing, stop and ask before proceeding.
 
@@ -193,6 +194,8 @@ If the destination is inside a plugin directory, apply a **minor bump** to the `
 
 Invoke the `kyberforge:agent-audit` skill directly on the created files to confirm the pair is valid before closing.
 
+**Commit verification.** Capture `git log --oneline -1` before Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the new agent files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the agent as done once the hash has actually changed.
+
 ## Improving an existing agent
 
 ### Step 1 — Verify inputs
@@ -201,6 +204,8 @@ Confirm the agent files exist and at least one improvement signal is present in
 
 If no signals: "This skill applies existing signals to an agent. For a blind review, examine the files manually or run a grill session first."
 
+Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed.
+
 **Partial state** — if one provider file exists but the other does not, scaffold the missing file first (run `bash scripts/new-agent.sh <name> <root>` — the file-by-file no-op means only the missing file is created), then continue with the improve flow on both files.
 
 ### Step 2 — Gather and group signals
@@ -231,3 +236,5 @@ Re-run the validation checklist from the create flow's Step 5 on any edited file
 If the agent lives inside a plugin directory, apply a **patch bump** to the `version` field in both `plugin.json` and `.claude-plugin/plugin.json` at the plugin root in the same edit pass (e.g. `1.0.4` → `1.0.5`).
 
 Invoke the `kyberforge:agent-audit` skill directly on the edited files to confirm no regressions before closing.
+
+**Commit verification.** Capture `git log --oneline -1` at the start of Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the changed files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the improvement as done once the hash has actually changed.