docs(kyberforge): document source_keys as 4th apm-agent-allowlist field

field-inventory.md's apm-agent-allowlist and validate.sh's runtime
check already included source_keys as a 4th allowed field, and the
apm-agent.md template already instructed authors to add it for
provenance tracking — but SKILL.md (x2), README.md, ADR-0016, and
deployment-modes.md still described the allowlist as name/description/
model, "nothing else". The template itself even contradicted its own
source_keys guidance with a header claiming "ONLY the three fields
below — full stop" directly above it.

Updates all six locations to document source_keys as the intentional
4th field, resolving the contradiction.

plugins/kyberforge/skills/agent-author/assets/templates/apm-agent.md

@@ -7,7 +7,8 @@
      incompatible vocabularies, and Claude-only fields (isolation, maxTurns,
      effort, memory, permissionMode) have no Copilot equivalent. A value correct
      for one harness is guaranteed wrong on the other, so this scope carries
-     ONLY the three fields below — full stop (see ADR-0016).
+     ONLY the fields below — full stop (see ADR-0016). `source_keys` is
+     provenance metadata, not a runtime field, and is exempt from that rule.
 
      Do NOT add: tools, isolation, maxTurns, effort, memory, permissionMode,
      disallowedTools, skills, color, initialPrompt, background, hooks, or