feat(knowledge): preview moved directory candidates

[akoita]

Summary

• add a separate read-only projection for deterministic directory moved/rename candidates
• emit candidates only for unique one-to-one exact media-type, checksum, and size matches
• preserve the established refresh-status and add-members contracts while returning deeply frozen path-free results
• synchronize the CKB ADR, architecture, privacy guidance, threat model, and roadmap

This is the fifteenth bounded slice of #110 in milestone #2.

Safety and scope

• exactly one bounded refresh scan is reused
• only active same-member missing sources with verified latest managed backing are eligible
• one-to-many, many-to-one, and many-to-many integrity tuples are ambiguous and emit no candidate
• retired, origin-conflict, unbound, current, changed, and unmanaged sources cannot become candidates
• names, paths, path similarity, ordering, extracted text, checksums, content, and version IDs are not exposed
• newSourceCount remains the total unmatched accepted-file count, including advisory candidates
• no IDs or storage writes occur; source identity, origins, membership, versions, bytes, observations, retirements, and journal state remain unchanged
• applied rename, membership revision, root rebind, adapters, indexing, background refresh, and cleanup remain deferred

Validation

• pnpm format
• focused application tests: 77 passed
• pnpm validate
• full Vitest suite: 706 passed
• release/security suite: 52 passed
• git diff --check

No conflicts were resolved because the branch was created from the current main.