refactor(kyberforge): move audit guidance out of the per-run rubric load

skill-audit loaded roughly 4,268 words of rubric on every run, most of it
criteria for findings a clean skill never triggers. The auditing guidance moves
into finding-criteria.md, read only when a finding is actually raised, cutting
a clean audit to about 999 words. The named-skill exemption is replaced with
properties, so the rubric stops carrying a list that ages the moment a skill
is renamed.

apm-workflow's `type:` trap sat in one flow while biting several, so it is
promoted to a common gate reachable from all of them; its claim to be
self-contained was untrue once it started routing to apm-install. skill-author's
contract had drifted from body-discipline.md and is realigned, and agent-audit's
field inventory is brought in line with the same split.

plugins/kyberforge/skills/skill-audit/references/body-discipline.md

@@ -80,14 +80,28 @@ table** plus the gates common to every branch, and each flow lives in its own se
 `references/` file. Inlining all of them is a FAIL regardless of word count, because every
 invocation then pays for every branch it did not take.
 
-The reference shape in this repo is `apm-workflow`: a **237-word body** dispatching to roughly
-3,400 words of references across five mutually exclusive invocations. Its whole-file count is 304
-words — cite 237 when calibrating a body, or the conflation this section warns against reappears
-in the finding itself.
+The reference shape in this repo is `apm-workflow`: a **294-word body** dispatching to 3,154 words
+of references across five mutually exclusive flows. Its whole-file count is 348 words — cite 294
+when calibrating a body, or the conflation this section warns against reappears in the finding
+itself. The 3,154 counts the five flow files only; `references/sources.md` is a provenance record
+and is never loaded at runtime, so counting it inflates the dispatched total.
 
-Note its wiring: a three-column table (invocation, action, reference file) closed by one line,
-*"Read only the reference file matching the requested action …"* That is the endorsed shape, and it
-is why the literal-conditional requirement above exempts a body that dispatches. Do not flag it.
+### What earns the wiring exemption
+
+A dispatch table earns the exemption above on its properties, not on which skill it appears in.
+Audit any dispatching body against these four:
+
+- Every flow the skill handles has a row, and every row names a target file that exists on disk.
+- Each row pairs a condition the agent can evaluate from the request with exactly one target. A row
+  keyed on a literal slash invocation fails this: a model-invoked activation never produces that
+  string, so the routing silently falls to whatever else the row carries.
+- One line after the table tells the agent to read the file its row matched, and only that one.
+- The gates every branch needs sit in the body, not inside one flow's file — see the reachability
+  precondition below.
+
+A table missing any of the four is not exempt, and the literal-conditional requirement applies to it
+as written. The exemption covers the wiring form only: every other rule in this file applies to a
+dispatching skill exactly as it applies to any other.
 
 ## Gotchas sections
 
@@ -184,24 +198,5 @@ Use pypdf, pdfplumber, PyMuPDF, or pdf2image...
 Use pdfplumber for text extraction. For scanned PDFs requiring OCR, use pdf2image instead.
 ```
 
-## Auditing guidance
-
-Flag as FAIL if:
-
-- A sentence answers "no" to the core test — it is padding
-- The body exceeds 900 words counted body-only (`validate.sh` reports it)
-- Two or more mutually exclusive flows are inlined instead of dispatched
-- A Gotcha paraphrases a step in the body below it that every branch reaching the Gotcha also
-  reaches
-- A decision point presents a menu of options with no default
-- An instruction repeats content already in the description
-- A prescriptive sequence is used where flexibility is fine, or the reverse
-
-Flag as SUGGESTION if:
-
-- The body exceeds 600 words counted body-only but stays at or under 900
-- The Gotchas section carries more than five entries
-- The Gotchas section exceeds 25% of the body
-- A rationale is missing from an include/exclude rule — present but unexplained
-- Gotchas are correct but placed late in the body rather than near the top
-- Content that only one branch reaches is inlined where a `references/` file would serve
+The FAIL and SUGGESTION criteria for this dimension live in `references/finding-criteria.md`,
+which Step 3 loads on every run.