feat: federate knowledge portfolios and harden capture

[0thernet]

Summary

• add an explicit versioned portfolio registry, stable kb:// identities, access-scoped federated search, audit, and opt-in search rules
• add durable capture inspection, integrity verification, Git-backed diffs, resumable jobs, and strict untrusted-content transport
• publish the CLI, SDK, documentation, package exports, generated distribution, and dynamic release-surface gates as @hraness/kb 0.17.0

Verification

• bun run check
• 1,174 tests passed
• installed-package smoke passed
• generated distribution was byte-stable across consecutive builds
• git diff --check

[0thernet]

Superseded by #6 from the same verified head. The replacement gives GitHub a fresh pull_request event after this PR was originally opened with invalid workflow YAML.