docs(kyberforge): document source_keys as 4th apm-agent-allowlist field

field-inventory.md's apm-agent-allowlist and validate.sh's runtime
check already included source_keys as a 4th allowed field, and the
apm-agent.md template already instructed authors to add it for
provenance tracking — but SKILL.md (x2), README.md, ADR-0016, and
deployment-modes.md still described the allowlist as name/description/
model, "nothing else". The template itself even contradicted its own
source_keys guidance with a header claiming "ONLY the three fields
below — full stop" directly above it.

Updates all six locations to document source_keys as the intentional
4th field, resolving the contradiction.

plugins/kyberforge/skills/agent-author/assets/README.md

@@ -6,4 +6,4 @@ Annotated agent definition templates copied by `scripts/new-agent.sh` when scaff
 
 - **`claude-code.md`** — Claude Code agent definition template (project/user scope). Includes all supported frontmatter fields (required and optional) with inline guidance comments and `FILL IN:` placeholders.
 - **`copilot.agent.md`** — Copilot CLI agent definition template (CLI format, project/user scope). Excludes cloud/IDE-only fields (`target`, `user-invocable`, `disable-model-invocation`, `mcp-servers`) and Claude Code-only fields. Uses Copilot tool aliases (`execute`, `read`, `edit`, `search`, `agent`, `web`).
-- **`apm-agent.md`** — Vendor-neutral APM agent definition template (plugin/APM scope). Only `name`, `description`, and optional `model` in frontmatter — no `tools` and no Claude-only fields, since `apm compile` copies frontmatter verbatim to both the Claude Code and Copilot CLI targets with no per-target integrator (ADR-0016).
+- **`apm-agent.md`** — Vendor-neutral APM agent definition template (plugin/APM scope). Only `name`, `description`, optional `model`, and optional `source_keys` (provenance metadata, not a runtime field) in frontmatter — no `tools` and no Claude-only fields, since `apm compile` copies frontmatter verbatim to both the Claude Code and Copilot CLI targets with no per-target integrator (ADR-0016).

plugins/kyberforge/skills/agent-author/assets/templates/apm-agent.md

@@ -7,7 +7,8 @@
      incompatible vocabularies, and Claude-only fields (isolation, maxTurns,
      effort, memory, permissionMode) have no Copilot equivalent. A value correct
      for one harness is guaranteed wrong on the other, so this scope carries
-     ONLY the three fields below — full stop (see ADR-0016).
+     ONLY the fields below — full stop (see ADR-0016). `source_keys` is
+     provenance metadata, not a runtime field, and is exempt from that rule.
 
      Do NOT add: tools, isolation, maxTurns, effort, memory, permissionMode,
      disallowedTools, skills, color, initialPrompt, background, hooks, or