chore(sdkx): bump sdk to v0.2.3 + deprecate knowledge/watcher for v0.3.0

[lIang70]

Summary

Two small changes that belong in the same sdkx release window:

1. Bump sdkx/go.mod from sdk v0.2.2 → v0.2.3

Atomic follow-up to PR #47: pick up the just-released sdk/v0.2.3 (cut by auto-tag against the PR #47 merge commit). PR #47 deliberately suppressed sdkx's auto-tag via [skip-tag:sdkx] so that the dep bump and the corresponding sdkx tag could be cut as one self-contained chore — this commit is the dep-bump half. The sdkx code that adopted the new sdk APIs (errdefs.ClassifyProviderError, telemetry.AttrXxx, errdefs.NotAvailable wrapping in retrieval/recall storage paths, etc.) already shipped inside the PR #47 merge using the local module imports; this commit only switches the published dep coordinate.

Mechanics:

cd sdkx
go get github.com/GizClaw/flowcraft/sdk@v0.2.3
go mod tidy

go.sum side-effect: github.com/expr-lang/expr v1.17.8 falls out of the indirect set. sdkx never directly imports sdk/graph (only errdefs, llm, telemetry, retrieval, recall, embedding), so expr — sdk/graph's edge-condition compiler — was always a spurious transitive that earlier tidies happened to keep around. sdk/v0.2.2..v0.2.3 contains zero changes to sdk/go.mod, so this is purely a re-tidy artefact, not a behaviour change.

2. Deprecate sdkx/knowledge/watcher for sdkx/v0.3.0

Every type this package consumes from sdk/knowledge — *FSStore, ChangeNotifier, NewReloader — has been marked // Deprecated: in sdk/knowledge/deprecated.go and is scheduled for removal in sdk/v0.3.0. Once those go away sdkx/knowledge/watcher cannot compile against the new sdk, so the package will be dropped entirely in sdkx/v0.3.0.

The replacement is architecturally different: sdk's v0.3.0 EventNotifier emits typed knowledge.ChangeEvent values (DatasetID / DocName / Kind) rather than opaque struct{} ticks, and pairs with NewEventReloader (scope-aware, serialised). No in-place upgrade is possible — call sites have to be rewritten against factory.NewLocal + a typed EventNotifier impl + the new EventReloader. The package doc spells out the migration shape so downstream callers have a release window to plan instead of being surprised by the v0.3.0 hard break.

Surface marked // Deprecated::

• the package doc (full migration map + rationale)
• type Notifier (points to package doc)
• func New(ctx, store) (points to package doc)

Interface-method receivers (Events, Close) are not individually annotated — any caller already trips SA1019 on the constructor / type / the deprecated knowledge.ChangeNotifier interface they implement, so double-annotating adds noise without catching anything new.

watcher_test.go is the only in-tree caller of the deprecated surface and exists exactly to keep the v0.2.x compatibility window honest. Added //lint:file-ignore SA1019 at the top so static analysis treats "tests of a deprecated package" as intended.

A typed fsnotify-backed EventNotifier replacement will ship inside sdkx itself post-v0.3.0; until then the deprecated package keeps working against sdk/v0.2.x and is the recommended bridge for them.

Out of scope (intentional)

• sdkx/internal/testenv is NOT deleted. It is the active shared .env loader for sdkx/llm/provider_integration_test.go and sdkx/embedding/embedding_integration_test.go (mirrors sdk/knowledge/e2e/internal/testenv on the sdk side). internal here is the Go visibility boundary, not a code-smell flag; removing it would silently break those integration test binaries.
• voice/go.mod still pins sdk v0.2.2; bench/go.mod pins v0.2.0; examples/chatbot-with-recall uses a replace on the local sdk. They will be bumped on their own cadence — this round is sdkx-only by user scope.

Auto-tag policy after merge

.github/workflows/auto-tag.yml will see only sdkx/** change in the merge commit, find no skip marker, and cut sdkx/v0.2.2 (next patch after sdkx/v0.2.1) against the merge commit. sdk/ and voice/ will be untouched (no diff under those prefixes).

Test plan

• go build ./... green in sdkx/ against sdk@v0.2.3.
• go vet ./knowledge/watcher/... clean (file-level SA1019 ignore in the test file is the only suppression).
• go test ./... green in sdkx/ (no FAIL lines), watcher tests included.
• After merge: confirm auto-tag cut sdkx/v0.2.2 and that no sdk/ or voice/ tag was created.