fix: add knowledge contract release conformance

[andrei-hasna]

Fixes #47.

Factory run: run_4762a0a5992d produced the candidate. Factory opened no PR because green-before-PR blocked on a pre-existing base test failure: base 8fb930a already failed bun run test with 37 private-ref/fixture failures, and factory attributed the candidate test failure as PRE-EXISTING with no new failing check.

Candidate gates measured:

• bun run contracts:conformance passed.
• contracts no-cloud-scan . passed.
• bunx tsc --noEmit passed.
• bun run build passed.
• bun run verify:generated passed after committing generated bundle updates; 6 generated bundles rebuild byte-identically.
• Staged secret scan passed after a directory-mode positive control detected a synthetic secret.
• Pre-push origin/main..HEAD secret scan passed after the same positive-control pattern.

Known pre-existing blocker not introduced by this PR: full bun run test is red on main with 37 failures from knowledge private-ref lint / fixture state.

Agent: Silvanus

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #63 @ 2ae2ce6 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

What I read:

• Exact diff from fetched base 8fb930a, including the full textual diffs for package.json, both fixtures, and bin/knowledge-mcp.js; bin/knowledge.js was reviewed with a forced text/word diff because Git classifies the minified generated file as binary.
• Surrounding release, contract, generated-artifact, and runtime paths: src/project-panel.ts, the project-panel CLI dispatch in src/cli.ts, tests/project-panel.test.ts, tests/package-release.test.ts, scripts/validate-public-package.mjs, scripts/verify-generated-artifacts.mjs, hasna.contract.json, and the pinned @hasna/contracts 0.8.5 conformance/no-cloud CLI implementation.
• The valid and invalid fixtures differ only by the intentionally duplicated metrics[1].id. Direct validation rejects the invalid fixture for exactly Project panel metric ids must be unique.

Commands and results:

• bun install — exit 0; setup only, not the test gate.
• Typecheck — no typecheck script is declared; none was invented.
• bun run test — exit 1; 378 pass, 25 fail, 2 skip, 405 total across 47 files. Re-runs with all mode selectors blank and then with HASNA_KNOWLEDGE_STORAGE_MODE=sqlite still received HASNA_KNOWLEDGE_STORAGE_MODE=cloud inside the test process from the machine-wide test guard; all 25 failures are that removed-selector error.
• bun run contracts:conformance — exit 0; 1 valid fixture accepted and 1 invalid fixture rejected.
• bun run contracts no-cloud-scan . — exit 0; package manifest, lockfile, and source-runtime checks passed.
• bun run contracts validate fixtures/project-panel.invalid.json --json — exit 1 as expected; the sole issue is the duplicate metric id.
• git diff --check origin/main...HEAD — exit 0.
• Independent CI evidence at this exact PR merge result is green: Ubuntu Bun reports 403 pass, 0 fail, 2 skip, and generated-artifact verification reports 6 bundles rebuild byte-identically. That does not change the requested requirement that the reviewer-run declared gate be green before GO.

Blocking P0/P1 findings:

• P1 required-gate failure: the declared local test gate did not exit 0 in this review environment. The PR cannot receive GO under the stated merge condition until bun run test is measured green in an environment where the test guard does not replace the explicit SQLite selector with removed cloud state.

Code/security findings:

• None. I found no reachable correctness, security, secrets, data-integrity, unsafe-mutation, or rollback defect in the changed release-hook/fixture/generated-artifact paths.

Non-blocking follow-ups:

• Repair or bypass the machine-wide test-guard environment propagation, then rerun only the named required gate. Existing green CI and the two passing PR-specific release checks make this a focused gate recheck, not a new whole-PR audit.