docs: add project knowledge index

[pekth]

Intent

Add a concise project knowledge index that makes the current repository state and its evidence boundaries easy to find. Keep this approved integration limited to docs/KB.md, preserve relative links, and do not claim deployment, store, runtime, or release facts that the repository cannot prove.

What Changed

• Added docs/KB.md as a concise index of current source and documentation state.
• Linked key project references and documented evidence boundaries and verification gaps.

Risk Assessment

✅ Low: Documentation-only change is bounded, links remain relative, and claims clearly distinguish repository evidence from external or unverified state.

Testing

Validated all relative links, confirmed only docs/KB.md changed, and confirmed unsupported release, installation, and runtime claims are explicitly excluded. No code tests run because change is documentation-only.

Evidence: Knowledge index validation evidence

Target: docs/KB.md
Commit: 9003b78

Semantic relative-link check:
- ../README.md -> exists
- PRIVACY.md -> exists
- DEMO.md -> exists
- COMPANION.md -> exists
- ../CONTRIBUTING.md -> exists
- ../CHANGELOG.md -> exists
- missing_relative_links: []

Diff scope check:
- changed file: docs/KB.md
- git diff --check: passed

Evidence-boundary review:
- KB explicitly separates source, assembled bundle, installed app, GitHub release, and runtime behavior.
- KB explicitly says external release/installation notes are not verified and must not be used as current release, installation, or runtime evidence.
- Open verification gaps explicitly call out installed app identity, release assets, and runtime provider behavior.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 2 issues found → auto-fixed ✅

• 🚨 docs/KB.md:13 - This claims “The vault records a public OSS release and local installation,” which is a release/deployment claim outside repository evidence and contradicts the requirement not to claim such facts without repository proof.
• ⚠️ docs/KB.md:13 - “No provider credentials are read directly” is inaccurate: OpenRouterQuotaSource.swift reads OPENROUTER_API_KEY or a local OpenRouter key. Narrow this claim to Codex/Claude credentials or mention the explicit OpenRouter exception.

🔧 Fix: Corrected unsupported release and credential claims
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• python3 semantic relative-link check for docs/KB.md
• git diff --check HEAD^ HEAD
• git diff --name-only HEAD^ HEAD
• Manual review of evidence-boundary wording

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.