fix(security): remove internal infra identifiers from published package

[andrei-hasna]

Summary

• DEFAULT_KNOWLEDGE_API_URL in src/auth.ts (used by the setup/auth CLI flow and the storage-contract default) previously hardcoded the internal host https://knowledge.hasna.xyz. Changed to the public product domain https://knowledge.md.
• Propagated the same change to src/workspace.ts (defaultKnowledgeConfig()), src/service.ts (normalizeMode alias check), src/cloud-store.ts (doc comment), src/cli.ts (doc comment), README.md, docs/migration and docs/examples, and tests.
• Rebuilt dist/ and bin/ (tracked/shipped build artifacts) via bun run build so the fix is present in what actually ships in the npm package, not just source.
• The truststore.pki.rds.amazonaws.com CA-bundle URL surfaced by the grep is a generic public AWS resource (RDS' public CA bundle download link used by any RDS+SSL client) and is not an internal identifier — left unchanged.

Important — residual leak NOT fixable from this repo

One default host template still resolves to https://knowledge.hasna.xyz at runtime: the self-hosted "client-flip" path (resolveKnowledgeCloudStore in src/cloud-store.ts) delegates to resolveStorageClient() from the @hasna/contracts npm dependency, whose defaultCloudBaseUrl(name) hardcodes `https://${name}.hasna.xyz` (confirmed in node_modules/@hasna/contracts/dist/client/transport.js). createClientTransport's override parameter only accepts fetchImpl/headers/timeoutMs/retry/sleepImpl — there is no supported override for the base URL, so this repo cannot fully close that path on its own.

• Documented this explicitly in tests/cloud-store.test.ts (renamed/annotated the relevant test) rather than silently changing its expectation to hide the gap.
• @hasna/contracts needs its own follow-up fix (change defaultCloudBaseUrl to a neutral public domain or require an explicit URL) before this class of leak is fully closed end-to-end. Flagging for a separate remediation PR in that repo.

Scrubbed identifier classes

• Internal API hostname: knowledge.hasna.xyz → knowledge.md (source, docs, README, tests, rebuilt dist/bin)

Needs patched republish after merge

Yes — dist/, bin/ are part of the npm-published files and currently ship the old default. A patch version bump + npm publish is required after merge to actually remove the leaked default from installed copies. (Per task instructions, no publish was performed here.)

Test plan

• bun install && bun run build succeeds, regenerates dist//bin/ with no knowledge.hasna.xyz references in own source
• bun test — 165 pass / 6 fail, 2 skip — fail count and specific failing tests are identical to a pristine main checkout (pre-existing environment/legacy-workspace-state failures, unrelated to this change; verified by diffing failure lists between pristine and fixed clones)
• Manual grep sweep for hasna.xyz, hasna-xyz-infra, hasna/xyz/, amazonaws across tracked files post-fix