feat(knowledge): record directory refresh observations

[akoita]

Summary

• add an explicit bounded directory scan that atomically records path-free current, changed, and same-member missing observations
• classify rebound, unmatched, outside-root, and unbound origins as origin conflicts while keeping retired and new files report-only
• guard the observation batch against membership, latest-version, origin-revision, retirement, chronology, and partial-write races
• preserve prior successful-refresh evidence and make no source, version, blob, membership, origin, retirement, or journal changes
• synchronize ADR, architecture, privacy, threat-model, and roadmap documentation

This is the tenth bounded implementation slice for #110 and remains within milestone #2. It records scan evidence only; changed-byte application, new-member persistence, rename/removal decisions, directory-root rebind, automatic retirement/deletion, adapters, indexing, and background refresh remain deferred. No schema migration is required.

Validation

• pnpm format
• pnpm lint
• pnpm typecheck
• pnpm test (692 Vitest tests; 52 release/security tests)
• pnpm validate
• git diff --check

Conflicts

No merge conflicts were encountered.