feat(knowledge): apply directory refresh changes

[akoita]

Summary

• add an explicit applied directory refresh for existing active same-member files
• append changed bytes through guarded managed-file publication while preserving source identity and immutable membership
• record guarded current/missing observations and return deterministic path-free partial results
• synchronize the CKB ADR, architecture, privacy, threat model, and roadmap

This is the eleventh bounded slice of #110 in milestone #2.

Safety and scope

• complete bounded scan occurs before mutation
• changed members are processed deterministically by source ID
• version, origin revision, and canonical origin path are checked atomically
• retired, origin-conflict, and unmatched/new files remain report-only
• no schema migration
• new-member persistence, rename/removal policy, directory-root rebind, automatic retirement/deletion, adapters, indexing, background refresh, and multi-member atomicity remain deferred

Validation

• pnpm format
• pnpm validate
• focused application/storage tests: 129 passed
• full Vitest suite: 694 passed
• release/security suite: 52 passed
• git diff --check

No conflicts were resolved because the branch was created from the current main.