fix(kyberforge): resolve PR #144 review and audit round 1

- factory-audit: no-op hooks, ./ after interpreters, split-quote and
  spaced ${PLUGIN_ROOT} paths, camelCase events in Claude-targeted flat
  files, case-insensitive routing stems, and non-string YAML keys are
  now caught; input: forms and prompt boundary clauses align with
  primitive-author; bats 347 -> 367
- primitive-author: routing forms, quoting guidance, install exit on
  hidden Unicode, argument-hint exception
- forge: drop duplicated gotcha, fit description and body budgets (#143)
- skill-author: primitive-author boundary, Claude-only env vars
- hook: exit unless CLAUDE_PROJECT_DIR is set, so Copilot/Codex never
  run apm update; ADR-0019 correction, ADR-0025 amendment, docs fixes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

plugins/kyberforge/.apm/skills/skill-author/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: skill-author
 description: >
-  Use when the user wants to create a new skill from scratch, or apply audit
-  findings, grill output, eval results, or inline feedback to an existing one.
-  Not read-only review -> `factory-audit`. Not agent files -> `agent-author`.
+  Use when creating a new skill, or applying audit findings, grill output, eval
+  results or feedback to an existing one. Not read-only review ->
+  `factory-audit`. Not agents -> `agent-author`. Not hooks, instructions or
+  prompts -> `primitive-author`.
 allowed-tools: Bash Read Write Edit
 metadata:
   version: "1.0.6"

plugins/kyberforge/.apm/skills/skill-author/references/deployment-modes.md

@@ -31,9 +31,9 @@ For a package (an `apm.yml`-governed `.apm/` source tree), the deployable artifa
 
 Fix: duplicate the file into the skill's own `scripts/` or `assets/`, same as plugin mode. `apm.yml`'s `includes:` list (when explicit, not `auto`) controls what gets published from the package, but it is not a cross-skill sharing mechanism — each skill directory must still stand alone.
 
-## Env vars (plugin mode only)
+## Env vars (Claude Code plugin install only)
 
-These variables are injected when the plugin is loaded from an install cache. They are **not available in standalone mode.**
+Claude Code injects these when it loads the plugin from its install cache. Other harnesses do not, and neither does standalone mode — so they are Claude Code-specific, unlike the target-neutral `${PLUGIN_ROOT}` hook token that apm rewrites per target.
 
 | Variable | Value |
 |----------|-------|
@@ -48,7 +48,7 @@ Deployed directly to `~/.agents/skills/<name>/`. No plugin context, no env vars
 
 ## Cross-tool portability
 
-`SKILL.md` is portable — the same file works in Claude Code and Copilot CLI, whether deployed standalone or compiled from an APM package. `apm.yml` is the source manifest: it is itself tool-agnostic (one file describes the package regardless of target), but `apm compile` produces per-target compiled output — a Claude Code plugin tree, a Copilot CLI tree, etc. — from it. Legacy hand-authored manifest files (`plugin.json`, `hooks.json`) are tool-specific and authored separately per tool; they sit outside the `apm.yml`-based flow.
+`SKILL.md` is portable — the same file works in Claude Code and Copilot CLI, whether deployed standalone or compiled from an APM package. `apm.yml` is the source manifest: it is itself tool-agnostic (one file describes the package regardless of target), but `apm compile` produces per-target compiled output — a Claude Code plugin tree, a Copilot CLI tree, etc. — from it. A legacy hand-authored `plugin.json` is tool-specific and sits outside the `apm.yml`-based flow. Hooks are apm primitives under `.apm/hooks/`, authored by `primitive-author`.
 
 ## Shared assets between skills