feat(knowledge): retire missing directory members

[akoita]

Summary

• add an explicit approved operation to logically retire one missing directory member
• require a fresh bounded scan plus active same-member, latest-version, origin-revision, and chronology guards
• return frozen path-free removed or already-removed results while preserving immutable evidence
• synchronize the CKB ADR, architecture, privacy guidance, threat model, and roadmap

This is the thirteenth bounded slice of #110 in milestone #2.

Safety and scope

• approval is checked before opening or scanning the store
• only an active same-member member classified as missing by the fresh scan can be newly retired
• logical retirement reuses the existing user-requested marker; no schema migration is required
• source bytes, versions, origin bindings, refresh observations, journal state, and immutable directory membership remain unchanged
• results expose no paths, filenames, content, checksums, media metadata, or labels
• complete removal reconciliation, rename inference, root rebind, physical cleanup, adapters, indexing, background refresh, and writer coordination remain deferred

Validation

• pnpm format
• focused application/storage/index tests: 165 passed
• pnpm validate
• full Vitest suite: 701 passed
• release/security suite: 52 passed
• git diff --check

No conflicts were resolved because the branch was created from the current main.