feat(knowledge): bind applications to explicit CKB and source-version snapshots

[akoita]

Parent program: #78

Outcome

Make every application and run explicitly select the reusable CKB data it may use and record an immutable source-version snapshot.

Scope

• Create one default CKB while supporting optional additional isolated CKBs.
• Select one CKB or an explicitly approved combination per application.
• Record CKB IDs, source IDs, and source versions in application and run history.
• Reject archived, deleted, stale-unready, or unselected material at the application boundary.
• Preserve strict isolation between CKBs and workspaces.
• Invalidate or require review when selected sources change after a run begins.
• Leave retrieval/index construction, version binding, freshness, and query enforcement to feat(retrieval): build knowledge-base-scoped lexical RAG with lifecycle evidence #80, which consumes this completed source-version snapshot boundary.

Acceptance criteria

• A new candidate has one usable default CKB.
• Multiple CKBs coexist without provenance or retrieval leakage.
• Every application and run exposes the exact selected source-version snapshot.
• Combining CKBs requires explicit user action.
• Restart and migration round trips preserve the selection.
• The snapshot contract is ready for feat(retrieval): build knowledge-base-scoped lexical RAG with lifecycle evidence #80 to attach retrieval/index versions without reopening CKB selection semantics.
• pnpm validate passes.

Parent program

• feat(knowledge): manage reusable candidate knowledge bases and source lifecycle #78