fix: reap only our own jobs, and say why a vale probe missed

batch_run ended with a bare wait, which blocks on every background job the
calling shell has, not the ones it started. Harmless for all three current
callers, but a future caller that backgrounds anything of its own would have
batch_run block on it or consume its status. It now records each $! and reaps
exactly those PIDs.

The `wait "$pid" || true` there is load-bearing: unlike a bare wait, wait <pid>
returns the job's status, so without it a single failing job would abort the
set -e caller at the call site -- before run-tests.sh or sync-plugin-content.sh
could read their .status files and print a summary. Status semantics stay in
those files, exactly as before.

check-vale-style-sync.sh's glob probe discarded vale's exit code and output and
decided purely on a grep, so a failed exec, an OOM-killed vale or a full TMPDIR
was indistinguishable from a real glob defect -- both printed "its glob sections
do not cover a path" with no evidence. A flake seen once in this probe could not
be diagnosed afterwards for that reason. The probe now attaches vale's rc and
output: a genuine glob defect reads "vale exited 0 ... in 0 files", a killed vale
reads "vale exited 137; output: <empty>".

That flake was investigated and not reproduced -- 1680 probes across three
contention setups including an offline namespace, all clean -- so nothing is
changed speculatively. The misattribution is worth recording: it was reported
against tests/test-vale-wrap.sh, which never invokes this script; the assertion
belongs to check-vale-style-sync.sh and reaches a log through a different suite.

Also drops the last stale field roster from agent-author's scaffolder. Its
next-steps hint enumerated "(name, description, model, body only)" -- omitting
disallowedTools, and never accurate anyway, since the template marks only
description and the body FILL IN. Its --help carried the inverted form, already
missing six forbidden fields. Both now state the shape rule and point at
field-inventory.md, and a bats case enforces all-or-nothing: name every
allowlisted field or name none, since a partial roster is the shape that goes
stale silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

plugins/kyberforge/.apm/skills/agent-author/tests/new-agent.bats

@@ -104,6 +104,40 @@ teardown() {
     done
 }
 
+# Same drift class as the assertion above, one step further out: the next-steps text
+# used to enumerate "(name, description, model, body only)" and went on printing that
+# after ADR-0016's amendment added disallowedTools. Rather than assert on wording, this
+# asserts the roster is all-or-nothing: if the guidance names any allowlisted field it
+# must name every one of them, so a partial restatement -- the only shape that can go
+# stale silently -- fails. Naming none, the current design, passes.
+@test "plugin/APM scope: next-steps guidance does not partially restate the allowlist" {
+    inventory="$BATS_TEST_DIRNAME/../../agent-audit/references/field-inventory.md"
+    [ -f "$inventory" ] || fail "field-inventory.md not found at $inventory"
+    allowlist="$(awk '
+        /^## apm-agent-allowlist$/ { insection = 1; next }
+        insection && /^##/ { exit }
+        insection && NF && $0 !~ /^#/ && $0 !~ /^---/ { print; exit }
+    ' "$inventory")"
+    [ -n "$allowlist" ] || fail "apm-agent-allowlist section is empty in $inventory"
+
+    printf 'name: my-package\ntype: skill\n' > "$ROOT/apm.yml"
+    steps="$(bash "$SCRIPT" my-agent "$ROOT" 2>&1 | sed -n '/^Next steps:/,$p')"
+    [ -n "$steps" ] || fail "scaffolder printed no next-steps block"
+
+    named=""
+    missing=""
+    for field in $allowlist; do
+        if grep -qw -- "$field" <<< "$steps"; then
+            named="$named $field"
+        else
+            missing="$missing $field"
+        fi
+    done
+    if [ -n "$named" ] && [ -n "$missing" ]; then
+        fail "next-steps names allowlisted field(s)$named but omits$missing -- a partial roster. Point at field-inventory.md instead of restating it."
+    fi
+}
+
 @test "plugin/APM scope: sources.md contributing-files template mentions the single-file path" {
     printf 'name: my-package\ntype: skill\n' > "$ROOT/apm.yml"
     bash "$SCRIPT" my-agent "$ROOT"