feat: federate knowledge portfolios and harden capture

[0thernet]

Summary

• add an explicit versioned portfolio registry, stable kb:// identities, access-scoped federated search, audit, and opt-in search rules
• add durable capture inspection, integrity verification, Git-backed diffs, resumable jobs, and strict untrusted-content transport
• publish the CLI, SDK, documentation, package exports, generated distribution, and dynamic release-surface gates as @hraness/kb 0.17.0
• add workflow-YAML validation and a manual CI fallback after GitHub exposed an invalid plain-scalar command in the original PR

Verification

• bun run check
• 1,176 tests passed
• installed-package smoke passed
• generated distribution was byte-stable across consecutive builds
• current-head GitHub CI dispatch passed, including Required
• git diff --check

Supersedes #5 so GitHub can create a fresh pull-request merge-ref check after that PR was opened with invalid workflow YAML.