docs(kyberforge): document source_keys as 4th apm-agent-allowlist field

field-inventory.md's apm-agent-allowlist and validate.sh's runtime
check already included source_keys as a 4th allowed field, and the
apm-agent.md template already instructed authors to add it for
provenance tracking — but SKILL.md (x2), README.md, ADR-0016, and
deployment-modes.md still described the allowlist as name/description/
model, "nothing else". The template itself even contradicted its own
source_keys guidance with a header claiming "ONLY the three fields
below — full stop" directly above it.

Updates all six locations to document source_keys as the intentional
4th field, resolving the contradiction.

docs/adr/0016-apm-agent-primitive-drops-provider-specific-fields.md

@@ -86,5 +86,7 @@ place.
   lists from `references/field-inventory.md` rather than hardcoding them, with a `source_keys`
   provenance chain — survives and is reused. Only the *content shape* changes for plugin scope:
   `field-inventory.md` shifts from two side-by-side CC-only/Copilot-only blocklists to one
-  vendor-neutral allowlist (`name`/`description`/`model`) for plugin-scope agents, while
+  vendor-neutral allowlist (`name`/`description`/`model`/`source_keys` — the last for provenance
+  tracking, validated separately by `validate-provenance.sh` against `sources.md`, not a
+  provider-specific field) for plugin-scope agents, while
   continuing to serve its original two-blocklist role for project/user-scope validation.