fix: reap only our own jobs, and say why a vale probe missed

batch_run ended with a bare wait, which blocks on every background job the
calling shell has, not the ones it started. Harmless for all three current
callers, but a future caller that backgrounds anything of its own would have
batch_run block on it or consume its status. It now records each $! and reaps
exactly those PIDs.

The `wait "$pid" || true` there is load-bearing: unlike a bare wait, wait <pid>
returns the job's status, so without it a single failing job would abort the
set -e caller at the call site -- before run-tests.sh or sync-plugin-content.sh
could read their .status files and print a summary. Status semantics stay in
those files, exactly as before.

check-vale-style-sync.sh's glob probe discarded vale's exit code and output and
decided purely on a grep, so a failed exec, an OOM-killed vale or a full TMPDIR
was indistinguishable from a real glob defect -- both printed "its glob sections
do not cover a path" with no evidence. A flake seen once in this probe could not
be diagnosed afterwards for that reason. The probe now attaches vale's rc and
output: a genuine glob defect reads "vale exited 0 ... in 0 files", a killed vale
reads "vale exited 137; output: <empty>".

That flake was investigated and not reproduced -- 1680 probes across three
contention setups including an offline namespace, all clean -- so nothing is
changed speculatively. The misattribution is worth recording: it was reported
against tests/test-vale-wrap.sh, which never invokes this script; the assertion
belongs to check-vale-style-sync.sh and reaches a log through a different suite.

Also drops the last stale field roster from agent-author's scaffolder. Its
next-steps hint enumerated "(name, description, model, body only)" -- omitting
disallowedTools, and never accurate anyway, since the template marks only
description and the body FILL IN. Its --help carried the inverted form, already
missing six forbidden fields. Both now state the shape rule and point at
field-inventory.md, and a bats case enforces all-or-nothing: name every
allowlisted field or name none, since a partial roster is the shape that goes
stale silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

scripts/check-vale-style-sync.sh

@@ -252,8 +252,16 @@ EOF_RE
 # carries a description with a token Kyberforge.VagueWording flags, so a config
 # whose glob matches but whose BasedOnStyles lost Kyberforge fails too: it would
 # lint the file and report nothing.
+# On a miss, the caller reports a glob defect -- but a miss is also what a failed
+# exec, an OOM-killed vale, or a full TMPDIR looks like, and discarding vale's rc
+# and output made those indistinguishable and evidence-free. A flake seen once in
+# this probe could not be diagnosed afterwards for exactly that reason. The rc and
+# output are now stashed for the caller to attach to its message; VALE_PROBE_DIAG
+# is set on every call, so a stale value from an earlier probe can never be
+# reported against a later one.
+VALE_PROBE_DIAG=""
 vale_flags_path() {
-  local cfg="$1" rel="$2" tmp out
+  local cfg="$1" rel="$2" tmp out rc=0
   tmp="$(mktemp -d)"
   mkdir -p "$tmp/$(dirname "$rel")"
   {
@@ -264,9 +272,16 @@ vale_flags_path() {
     echo ""
     echo "Body."
   } > "$tmp/$rel"
-  out="$(cd "$tmp" && vale --config "$cfg" "$rel" 2>&1)" || true
+  out="$(cd "$tmp" && vale --config "$cfg" "$rel" 2>&1)" || rc=$?
   rm -rf "$tmp"
-  printf '%s\n' "$out" | grep -qF "Kyberforge.VagueWording"
+  if printf '%s\n' "$out" | grep -qF "Kyberforge.VagueWording"; then
+    VALE_PROBE_DIAG=""
+    return 0
+  fi
+  # vale exits nonzero merely for *having* alerts, so rc alone proves nothing --
+  # it is evidence only alongside the absent alert.
+  VALE_PROBE_DIAG="vale exited $rc; output: ${out:-<empty>}"
+  return 1
 }
 
 # Missing vale is a HARD FAILURE, not a warning. Six of this script's assertions
@@ -328,7 +343,7 @@ while IFS='|' read -r skill rel scope; do
   fi
 
   if [[ "$VALE_AVAILABLE" == true ]] && ! vale_flags_path "$ini" "$rel"; then
-    err "$skill/assets/vale/.vale.ini raises no Kyberforge alert on $rel — its glob sections do not cover a path its own pre-commit hook is scoped to, so the hook passes that shape without linting it"
+    err "$skill/assets/vale/.vale.ini raises no Kyberforge alert on $rel — its glob sections do not cover a path its own pre-commit hook is scoped to, so the hook passes that shape without linting it [$VALE_PROBE_DIAG]"
   fi
 # `demo.md` (bare, no `.agent.md` suffix) is `hooks-only` rather than
 # `shared`: it exists only to exercise agent-audit's `[**/agents/*.md]` glob