refactor(kyberforge): move audit guidance out of the per-run rubric load

skill-audit loaded roughly 4,268 words of rubric on every run, most of it
criteria for findings a clean skill never triggers. The auditing guidance moves
into finding-criteria.md, read only when a finding is actually raised, cutting
a clean audit to about 999 words. The named-skill exemption is replaced with
properties, so the rubric stops carrying a list that ages the moment a skill
is renamed.

apm-workflow's `type:` trap sat in one flow while biting several, so it is
promoted to a common gate reachable from all of them; its claim to be
self-contained was untrue once it started routing to apm-install. skill-author's
contract had drifted from body-discipline.md and is realigned, and agent-audit's
field inventory is brought in line with the same split.

plugins/kyberforge/.apm/skills/skill-audit/references/file-structure.md

@@ -24,9 +24,19 @@ knows to look at. Flag any other directory as a FAIL.
 ## Cross-plugin path references
 
 A plugin is copied to a cache on install, and a path that climbs out of the skill directory stops
-resolving there. Flag any `../`, `../../`, or absolute repo path (`plugins/<plugin>/skills/<other>/`
-and its APM-native equivalent `.apm/skills/<other>/`) appearing in `SKILL.md`, `scripts/`,
-`references/` or `assets/`.
+resolving there. Flag a path in `SKILL.md`, `scripts/`, `references/` or `assets/` when it
+**resolves outside the skill directory** — an absolute repo path
+(`plugins/<plugin>/skills/<other>/` and its APM-native equivalent `.apm/skills/<other>/`), a
+plugin-root path (`docs/`, `bin/`), or a `../` chain that leaves the skill root.
+
+Resolve before flagging, twice over:
+
+- **Resolve the path.** `$SKILL_DIR/../assets/templates` climbs one level from a `scripts/`
+  directory and lands back inside the same skill, so it resolves in a cache install and is not a
+  finding. A bare `../` is not the defect; leaving the skill is.
+- **Skip fenced code blocks.** A path inside a fenced block is an example, and rubrics quote outside
+  paths deliberately as negative examples of what not to write. Flag a fenced path only when the
+  surrounding prose presents it as the form to copy.
 
 **Referring to another skill's file.** There is one sanctioned spelling, and it is possessive:
 `skill-audit's references/validation-scripts.md`. Write the skill by name and let the reader
@@ -39,9 +49,10 @@ on-disk check. Flag any other spelling of a cross-skill reference.
 Two directories are exempt, and the exemptions are structural rather than discretionary:
 
 - **`references/sources.md`.** Its `Research doc:` fields are development-time provenance pointers,
-  not runtime references. They are expected to be unresolvable after install, and
-  `validate-provenance.sh` handles that by skipping upstream checks silently when the path is
-  absent. Flagging them would make every correctly-provenanced skill fail.
+  not runtime references. They are expected to be unresolvable after install, so
+  `validate-provenance.sh` does not treat an absent path as a FAIL — it emits an INFO naming the
+  slug and stating that checks 7 and 8 did not run for it. Flagging them as broken references
+  would make every correctly-provenanced skill fail.
 - **`tests/`.** Test files are dev-only and may reference repo-level infrastructure such as a shared
   `tests/test_helper/`. The exemption is conditional on the dependency being declared: if `tests/`
   exists and `tests/README.md` is absent or does not document it, that is a FAIL.
@@ -60,19 +71,5 @@ The skill has to agree with itself. Three checks:
 A stale README row is the most common finding here and the easiest to miss from inside an
 authoring pass, because the author knows what was intended and reads it into the gap.
 
-## Auditing guidance
-
-Flag as FAIL if:
-
-- A directory outside the four permitted ones exists
-- Test files sit in `scripts/`
-- A non-spec file sits at the skill root
-- A cross-plugin or parent-relative path appears outside the two exempt locations
-- `tests/` exists but `tests/README.md` is missing or does not document its repo-level dependency
-- `README.md` is absent, or its file table has a missing or stale row
-- `SKILL.md` describes a script invocation the script does not accept
-
-Flag as SUGGESTION if:
-
-- An optional directory exists but holds only a placeholder README
-- `README.md` is accurate but describes a file's purpose more thinly than `SKILL.md` does
+The FAIL and SUGGESTION criteria for this dimension live in `references/finding-criteria.md`,
+which Step 3 loads on every run.