feat(knowledge): preview directory root rebind

[akoita]

Summary

• add a read-only eligibility preview for rebinding a persisted directory source to a user-selected candidate root
• require exact historical relative-path membership and latest managed-byte agreement across one bounded scan
• return only frozen path-free readiness and aggregate counts without allocating IDs or changing state
• synchronize the CKB ADR, architecture, privacy guidance, threat model, and roadmap

This is the fourteenth bounded slice of #110 in milestone #2.

Safety and scope

• only the candidate root is accessed; the historical root may already be moved or unavailable
• the candidate must be a real non-symlink directory outside the CKB store and cannot belong to another directory binding in the same CKB
• every historical member must remain active, same-member, unretired, managed, and byte-identical at the same normalized relative path
• missing, extra, changed, duplicate, unbound, conflicting, retired, or unmanaged cases fail closed with a generic path-free error
• binding, membership, origins, versions, managed bytes, observations, retirements, and journal state remain unchanged
• schema remains at v13; immutable binding and member triggers are preserved
• applying the root rebind, rename/removal reconciliation, adapters, indexing, background refresh, and cleanup remain deferred

Validation

• pnpm format
• focused application/storage/index tests: 168 passed
• pnpm validate
• full Vitest suite: 704 passed
• release/security suite: 52 passed
• git diff --check

No conflicts were resolved because the branch was created from the current main.