fix(kyberforge): resolve PR #144 review and audit round 1

- factory-audit: no-op hooks, ./ after interpreters, split-quote and
  spaced ${PLUGIN_ROOT} paths, camelCase events in Claude-targeted flat
  files, case-insensitive routing stems, and non-string YAML keys are
  now caught; input: forms and prompt boundary clauses align with
  primitive-author; bats 347 -> 367
- primitive-author: routing forms, quoting guidance, install exit on
  hidden Unicode, argument-hint exception
- forge: drop duplicated gotcha, fit description and body budgets (#143)
- skill-author: primitive-author boundary, Claude-only env vars
- hook: exit unless CLAUDE_PROJECT_DIR is set, so Copilot/Codex never
  run apm update; ADR-0019 correction, ADR-0025 amendment, docs fixes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/primitive-author/references/hook.md

@@ -86,9 +86,15 @@ Should:
    Claude receives `"*"`.
 9. Do not author Copilot's flat `bash` / `powershell` / `timeoutSec` keys in a Claude-shaped file;
    they render onto Claude as stray keys.
-10. Quote a script path that may contain spaces: `"${PLUGIN_ROOT}/scripts/my hook.sh"`.
+10. Keep script paths free of spaces, and when quoting, quote the whole token:
+    `"${PLUGIN_ROOT}/scripts/my-hook.sh"`. apm rewrites `${PLUGIN_ROOT}` only when a path separator
+    follows it directly, and only up to the next space or quote — so `"${PLUGIN_ROOT}"/scripts/x.sh`
+    is left unrewritten and a spaced path is cut short.
 11. Keep helper files in the hook directory non-JSON. Copilot's loader rejects any bundled `.json`
     without a `hooks` key.
 12. Prefer `${PLUGIN_ROOT}` over `${CLAUDE_PLUGIN_ROOT}`.
-13. No `hooks-<target>` or `*-<target>-hooks` filename. That routing is deprecated and reach belongs
-    to `targets:` (see Gate); the research allows it only when deprecated routing is intended.
+13. No filename that routes by target. Case-insensitively, apm routes a stem of exactly
+    `hooks-<target>` and any stem ending `<target>-hooks` — bare (`claude-hooks`), prefixed
+    (`x-claude-hooks`) or combined (`claude-codex-hooks`, the union). That routing is deprecated and
+    reach belongs to `targets:` (see Gate); the research allows it only when deprecated routing is
+    intended.