feat(skill-author): record research sources as skill provenance

Adds a sources provenance step to the skill creation workflow so the
chain from research output to skill content is traceable. Closes #4.

- New scaffold template `assets/templates/references/sources.md` mirroring
  the research skill's sources.md format (slug → URL, description,
  contributing files, status)
- `source_keys` commented-out optional field added to the SKILL.md
  template, mirroring how research topic files link back to sources
- New Step 5 in the creation workflow: populate references/sources.md
  from research input (attributing contributing skill files) or delete it
  if no research was provided; add source_keys to SKILL.md and any
  references/*.md files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

plugins/kyberforge/skills/skill-author/SKILL.md

@@ -47,7 +47,7 @@ Extract the skill from a real task you've done — a skill refined from real exe
 
 If any are missing, stop and ask the user before proceeding.
 
-**Requires `/skill-audit`** — used in Step 5 for final validation. Both skills ship in the kyberforge plugin and are co-installed. If `/skill-audit` is unavailable, stop and ask the user to install the kyberforge plugin before continuing.
+**Requires `/skill-audit`** — used in Step 6 for final validation. Both skills ship in the kyberforge plugin and are co-installed. If `/skill-audit` is unavailable, stop and ask the user to install the kyberforge plugin before continuing.
 
 ### Step 1 — Scaffold
 
@@ -180,7 +180,19 @@ not in `scripts/`. See `tests/README.md` for setup instructions.
 
 If not needed, delete the placeholder READMEs and their directories.
 
-### Step 5 — Validate and close
+### Step 5 — Populate or delete `references/sources.md`
+
+If a research `sources.md` is present in the conversation context:
+
+1. Read it and filter to entries with `` `extracted` `` status only.
+2. For each entry, determine which skill files it contributed to (SKILL.md and any files in references/ that drew from it). Update `Contributing files` accordingly — list skill files, not research topic files.
+3. Write the updated content to `references/sources.md`.
+4. Add `source_keys` to the frontmatter of `SKILL.md` (under `metadata`) listing the slugs of sources that informed it.
+5. For each file in `references/` that was informed by research sources, add `source_keys` frontmatter (same format as research topic files) listing the relevant slugs.
+
+If no research `sources.md` is in context, delete `references/sources.md`.
+
+### Step 6 — Validate and close
 
 Run `/skill-audit` on `<destination-dir>/<skill-name>`.