feat(knowledge): add directory refresh members

[akoita]

Summary

• add an explicit operation that persists unmatched accepted directory files as append-only CKB members
• atomically commit each source, initial version, origin binding, managed marker, journal event, and hashed membership row
• return deterministic path-free complete or partial results with safe retry behavior
• update the CKB ADR, architecture, privacy guidance, threat model, and roadmap

This is the twelfth bounded slice of #110 in milestone #2.

Safety and scope

• one complete bounded scan occurs before any mutation
• IDs are allocated only for unmatched accepted files
• each candidate is independently atomic and a later failure stops processing without rolling back earlier commits
• source paths, relative paths, checksums, media metadata, labels, and content are excluded from the result
• membership remains immutable after creation and survives append, rebind, retirement, and reopen
• schema remains at v13; no migration
• removal decisions, rename inference, directory-root rebind, automatic retirement/deletion, adapters, indexing, background refresh, and writer locks remain deferred

Validation

• pnpm format
• focused application/storage/index tests: 162 passed
• pnpm validate
• full Vitest suite: 698 passed
• release/security suite: 52 passed
• git diff --check

No conflicts were resolved because the branch was created from the current main.