fix: reap only our own jobs, and say why a vale probe missed

batch_run ended with a bare wait, which blocks on every background job the
calling shell has, not the ones it started. Harmless for all three current
callers, but a future caller that backgrounds anything of its own would have
batch_run block on it or consume its status. It now records each $! and reaps
exactly those PIDs.

The `wait "$pid" || true` there is load-bearing: unlike a bare wait, wait <pid>
returns the job's status, so without it a single failing job would abort the
set -e caller at the call site -- before run-tests.sh or sync-plugin-content.sh
could read their .status files and print a summary. Status semantics stay in
those files, exactly as before.

check-vale-style-sync.sh's glob probe discarded vale's exit code and output and
decided purely on a grep, so a failed exec, an OOM-killed vale or a full TMPDIR
was indistinguishable from a real glob defect -- both printed "its glob sections
do not cover a path" with no evidence. A flake seen once in this probe could not
be diagnosed afterwards for that reason. The probe now attaches vale's rc and
output: a genuine glob defect reads "vale exited 0 ... in 0 files", a killed vale
reads "vale exited 137; output: <empty>".

That flake was investigated and not reproduced -- 1680 probes across three
contention setups including an offline namespace, all clean -- so nothing is
changed speculatively. The misattribution is worth recording: it was reported
against tests/test-vale-wrap.sh, which never invokes this script; the assertion
belongs to check-vale-style-sync.sh and reaches a log through a different suite.

Also drops the last stale field roster from agent-author's scaffolder. Its
next-steps hint enumerated "(name, description, model, body only)" -- omitting
disallowedTools, and never accurate anyway, since the template marks only
description and the body FILL IN. Its --help carried the inverted form, already
missing six forbidden fields. Both now state the shape rule and point at
field-inventory.md, and a bats case enforces all-or-nothing: name every
allowlisted field or name none, since a partial roster is the shape that goes
stale silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

plugins/kyberforge/.apm/skills/agent-author/scripts/new-agent.sh

@@ -21,10 +21,12 @@ Arguments:
                                     without type: is a marketplace-only manifest
                                     and is skipped, the walk continues upward
                                → creates <package-root>/.apm/agents/<name>.agent.md
-                                 (single vendor-neutral file — no tools,
-                                 isolation, maxTurns, effort, memory, or
-                                 permissionMode; apm compile has no per-target
-                                 field integrator, see ADR-0016)
+                                 (single vendor-neutral file; apm compile copies
+                                 its frontmatter verbatim to every target with no
+                                 per-target field integrator, so the permitted
+                                 field set is narrow — see the apm-agent-allowlist
+                                 section of agent-audit's
+                                 references/field-inventory.md and ADR-0016)
                                → creates <package-root>/sources.md (if absent)
                 project scope    : no type:-bearing apm.yml found; root is a
                                     project directory
@@ -258,6 +260,19 @@ SOURCES
   fi
 fi
 
+# Next-steps guidance names no frontmatter fields, by rule (see references/scripts.md).
+# A roster restated in terminal output goes stale one step further out than the list
+# itself: the old "(name, description, model, body only)" hint outlived ADR-0016's
+# 2026-08-14 amendment, which added disallowedTools to the permitted set. Point at the
+# scaffolded file's own comments for what to fill, and at agent-audit's validate.sh —
+# which reads the allowlist from field-inventory.md as data — for what is permitted.
+AUDIT_SCRIPTS="$(cd "$SKILL_ROOT/../agent-audit/scripts" 2>/dev/null && pwd || true)"
+if [[ -n "$AUDIT_SCRIPTS" && -f "$AUDIT_SCRIPTS/validate.sh" ]]; then
+  VALIDATE_HINT="$AUDIT_SCRIPTS/validate.sh"
+else
+  VALIDATE_HINT="agent-audit's scripts/validate.sh"
+fi
+
 if [[ "$created_any" == false ]]; then
   echo "All files already exist — nothing to do." >&2
 else
@@ -266,12 +281,17 @@ else
   echo "" >&2
   echo "Next steps:" >&2
   if [[ "$SCOPE" == "plugin" ]]; then
-    echo "  1. Fill in $APM_FILE — replace all FILL IN: placeholders (name, description, model, body only)" >&2
+    echo "  1. Fill in $APM_FILE — replace every FILL IN: placeholder. Optional fields are" >&2
+    echo "     scaffolded there as commented blocks; uncomment the ones that apply." >&2
     echo "  2. Populate $SOURCES_DIR/sources.md with research sources, or delete it" >&2
-    echo "  3. Validate: check required fields (name, description, system prompt) in the file" >&2
+    echo "  3. Validate: $VALIDATE_HINT $APM_FILE" >&2
+    echo "     It checks the frontmatter against the apm-agent-allowlist section of" >&2
+    echo "     agent-audit's references/field-inventory.md, the authoritative field list." >&2
   else
-    echo "  1. Fill in $CC_FILE — replace all FILL IN: placeholders" >&2
-    echo "  2. Fill in $CP_FILE — replace all FILL IN: placeholders" >&2
-    echo "  3. Validate: check required fields (name, description, system prompt) in both files" >&2
+    echo "  1. Fill in $CC_FILE — replace every FILL IN: placeholder. Optional fields are" >&2
+    echo "     scaffolded there as commented blocks; uncomment the ones that apply." >&2
+    echo "  2. Fill in $CP_FILE — same, and heed its closing comment: the Claude Code-only" >&2
+    echo "     fields it names must not cross over from the file above." >&2
+    echo "  3. Validate: run $VALIDATE_HINT on each file" >&2
   fi
 fi