docs(kyberforge): document source_keys as 4th apm-agent-allowlist field

field-inventory.md's apm-agent-allowlist and validate.sh's runtime
check already included source_keys as a 4th allowed field, and the
apm-agent.md template already instructed authors to add it for
provenance tracking — but SKILL.md (x2), README.md, ADR-0016, and
deployment-modes.md still described the allowlist as name/description/
model, "nothing else". The template itself even contradicted its own
source_keys guidance with a header claiming "ONLY the three fields
below — full stop" directly above it.

Updates all six locations to document source_keys as the intentional
4th field, resolving the contradiction.

plugins/kyberforge/skills/agent-audit/README.md

@@ -7,7 +7,9 @@ plugin/APM scope, or a Claude Code and Copilot file pair at project/user scope.
 
 At **plugin/APM scope**, accepts the single `.apm/agents/<name>.agent.md` file — there is no
 counterpart. Structural checks via `validate.sh` hard-`FAIL` any frontmatter field outside the
-vendor-neutral allowlist (`name`, `description`, `model` — see ADR-0016), since `apm compile`
+vendor-neutral allowlist (`name`, `description`, `model`, `source_keys` — the last for
+provenance tracking, checked separately by `validate-provenance.sh` against `sources.md`; see
+ADR-0016), since `apm compile`
 copies frontmatter verbatim to both harnesses and an unsafe field can't be silently dropped for
 just one of them.