refactor(kyberforge): address #154 review and drop commit steps from author skills

- instructions-author: keep two Gotchas, move the rest to the Step 2 contract
  and verify.md; add references/content.md on what belongs in an instructions
  file and tighten the template bullets to match
- instructions-author, skill-author, agent-author: remove the commit
  verification step; committing is out of scope for author skills
- skill-author 1.0.6, agent-author 1.0.4 (ADR-0022 patch bumps)

Refs #148

Co-Authored-By: Claude Code <[email protected]>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/instructions-author/SKILL.md

@@ -20,9 +20,6 @@ metadata:
 
 - Claude Code drops `description`; only Copilot and Cursor keep it. Write a body that explains itself.
 - Quote every `applyTo`. An unquoted `**/*.py` fails to parse, compile skips the file, and `apm install` still deploys it with no `paths:`, so it loads in every session and nothing errors.
-- `apm compile --validate` always exits 0 and hides the missing-`description`, missing-`applyTo` and empty-body warnings. It is not a lint gate.
-- Once rules sit in `.claude/rules/`, `apm compile --target claude` writes no `CLAUDE.md` and still exits 0; an exit-code check verifies nothing.
-- A source must be flat in `.apm/instructions/` and end `.instructions.md`; anything else is ignored or never installed.
 
 ## Step 1 — Dispatch
 
@@ -34,7 +31,7 @@ metadata:
 
 Signals: grill output, audit findings, inline feedback, a session describing a rule that loaded when it should not or failed to load. With none, ask whether the user meant to create a new file or has feedback to apply.
 
-Read only the reference for the resolved flow. Capture `rtk git log --oneline -1` before touching the filesystem; Step 3 needs it.
+Read only the reference for the resolved flow.
 
 ## Step 2 — Contract
 
@@ -42,8 +39,9 @@ Gates on every file, whichever flow wrote it:
 
 - **One topic per file.** Two topics are two files.
 - **Scope.** Omit `applyTo` only for a rule that must load in every session, and tell the user it then costs context at every launch.
+- **Source.** Flat in `.apm/instructions/`, named `<stem>.instructions.md`. Anything nested or misnamed is ignored or never installed.
 - **Stem.** It becomes the deployed filename, and install overwrites a hand-authored rule of the same name on most targets without a prompt. Check for a collision before choosing it.
-- **Body.** Bullets, paths in backticks, nothing assuming another file is loaded, under 200 lines.
+- **Body.** Concrete, checkable bullets, paths in backticks, nothing assuming another file is loaded, under 200 lines. Whether the content belongs in an instructions file at all: read `references/content.md`.
 
 If a field, glob or location is in question, read `references/schema.md`. If the question is which target keeps which field, or what compile does, read `references/target-mapping.md`.
 
@@ -53,5 +51,3 @@ If a field, glob or location is in question, read `references/schema.md`. If the
 - [ ] Bump the owning package's `apm.yml` `version` — **minor** on create, **patch** on improve — because consumers compare it to detect updates.
 
 `factory-audit` has no instructions checks yet, so nothing else gates the file; report only what the verification showed.
-
-**Commit verification.** Once verification is clean, run `rtk git add` and `rtk git commit`. Re-run `rtk git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is lost if the tree is cleaned up. Report done only once the hash has changed.