fix(kyberforge): fix apm-scope validation gaps in agent/skill authoring scripts

Post-implementation review of PR #93 (issue #89's apm.yml-native retargeting
of skill-author/skill-audit/agent-author/agent-audit) found four confirmed
defects across the four scripts' apm.yml `type:` walk-up logic:

- field-inventory.md's apm-agent-allowlist was missing `source_keys`,
  contradicting agent-author/SKILL.md's own instruction (Step 5 checklist)
  to allow it at plugin/APM scope — a correctly-authored file with
  source_keys failed validate.sh.
- validate.sh's APM_TYPE_RE and validate-provenance.sh's TYPE_RE disagreed:
  the former tolerated a quoted `type: "skill"` value, the latter didn't,
  despite agent-audit/SKILL.md explicitly documenting that
  validate-provenance.sh walks up "the same way validate.sh does". Both
  also used `\b` word-boundary matching, which false-matches a malformed
  value like `type: prompts-only` on the `prompts` prefix. Unified both
  regexes to be quote-tolerant and require an exact value.
- All four scripts' `.git` project-boundary check used isdir()/[[ -d ]],
  which misses git worktrees where `.git` is a regular file (`gitdir: ...`)
  rather than a directory. Switched to exists()/[[ -e ]].
- new-agent.sh and new-skill.sh had the same quote-intolerance as above via
  inline `grep -qE` calls (new-skill.sh's also had the `\b` false-match
  bug); replaced both with a shared-shape `is_apm_package_manifest` bash
  helper matching the Python regex's semantics.

Four other findings from the same review turned out not to be bugs: a
bare `plugin.json` no longer signaling plugin scope is documented,
intentional behavior (agent-audit/SKILL.md:30, agent-author/SKILL.md:87),
deferred to issue #90's real plugin.json-to-apm.yml conversion — not
something this fix should reverse.

Verified via direct reproduction of each defect plus the full test suite:
147/147 bats tests, 39/39 shell-script tests, 12/12 summary categories.

Refs: #89

plugins/kyberforge/skills/skill-author/scripts/new-skill.sh

@@ -81,6 +81,26 @@ if [[ ! -d "$TARGET_INPUT" ]]; then
   exit 1
 fi
 
+# True if apm_yml's top-level `type:` line names one of the four APM package
+# types (instructions/skill/hybrid/prompts) — tolerating an optional matching
+# quote around the value and requiring the value end there, so a malformed
+# value like `prompts-only` doesn't false-match on the `prompts` prefix.
+# Identical to agent-author's new-agent.sh copy of this helper.
+is_apm_package_manifest() {
+  local apm_yml="$1" line value
+  while IFS= read -r line; do
+    [[ "$line" =~ ^type:[[:space:]]*(.*)$ ]] || continue
+    value="${BASH_REMATCH[1]}"
+    value="${value%%[[:space:]]*}"
+    value="${value#\"}"; value="${value%\"}"
+    value="${value#\'}"; value="${value%\'}"
+    case "$value" in
+      instructions|skill|hybrid|prompts) return 0 ;;
+    esac
+  done < "$apm_yml"
+  return 1
+}
+
 # ---------------------------------------------------------------------------
 # Walk up from <path> looking for a type-bearing apm.yml (package mode) or a
 # .git boundary / filesystem root (standalone mode). An apm.yml with no
@@ -92,7 +112,7 @@ find_package_root() {
   current="$(cd "$1" && pwd)"
   while true; do
     if [[ -f "$current/apm.yml" ]]; then
-      if grep -qE '^type:[[:space:]]*(instructions|skill|hybrid|prompts)\b' "$current/apm.yml"; then
+      if is_apm_package_manifest "$current/apm.yml"; then
         echo "$current"
         echo "package"
         return 0
@@ -100,7 +120,9 @@ find_package_root() {
       # apm.yml exists but has no type: field — marketplace-only manifest.
       # Not a package match; keep walking up.
     fi
-    if [[ -d "$current/.git" ]]; then
+    # .git is a directory in a normal checkout but a file (`gitdir: ...`) in
+    # a git worktree — -e covers both.
+    if [[ -e "$current/.git" ]]; then
       echo "$current"
       echo "no-package"
       return 0