refactor(kyberforge): move audit guidance out of the per-run rubric load

skill-audit loaded roughly 4,268 words of rubric on every run, most of it
criteria for findings a clean skill never triggers. The auditing guidance moves
into finding-criteria.md, read only when a finding is actually raised, cutting
a clean audit to about 999 words. The named-skill exemption is replaced with
properties, so the rubric stops carrying a list that ages the moment a skill
is renamed.

apm-workflow's `type:` trap sat in one flow while biting several, so it is
promoted to a common gate reachable from all of them; its claim to be
self-contained was untrue once it started routing to apm-install. skill-author's
contract had drifted from body-discipline.md and is realigned, and agent-audit's
field inventory is brought in line with the same split.

plugins/kyberforge/skills/skill-author/references/retrofit.md

@@ -96,6 +96,13 @@ them for you. After every retrofit that adds, removes or renames a file:
       content moved into it, and remove any file the retrofit deleted. This is the one that gets
       missed: `sources.md` keeps citing sections of `SKILL.md` that no longer exist, the
       provenance check still exits 0, and the stale claim survives review.
+- [ ] **Reachability of every relocated gate.** For each Gotcha or gate the retrofit moved out of
+      the body, list the flows that need it and confirm each one reaches the surviving copy. A gate
+      that lands in a single flow file is invisible to every other branch, and no gate detects
+      that: `/skill-audit` reads whichever file it was handed, and the word counts improve either
+      way. Where more than one flow needs it, the copy belongs in the body's common-gates section,
+      not in a flow file. Grep the skill for the gate's key term and check every branch that hits
+      zero.
 - [ ] Re-run `/skill-audit` and confirm its `### Provenance` dimension does not report the new
       file as missing `source_keys`.