Harden Cognee policy and shell lint

[JTInventory]

What Changed

• Hardened Cognee lookup, source verification, telemetry, and cost-probe scripts so policy-gated lookup stays manual, hint-only, and safer around missing or stale authority.
• Expanded supervision routing and watcher behavior, including stale CI/check handling, secondmate safety checks, and brief/watch session coverage.
• Added Cognee policy and configuration documentation, plus updated contributor, architecture, and CI docs to match the supervision and lookup guardrails.

Verification

• no-mistakes review/test/document/lint completed in runs 01KWCXJ9Q9HXQ82F90HWH0P38J and 01KWCZCTJENEJG5T16P004ECMA.
• git diff --check
• shellcheck -x -P SCRIPTDIR bin/*.sh tests/*.sh
• bash -lc 'for test_script in tests/*.test.sh; do bash "$test_script" || exit 1; done'

Pipeline

Updates from git push no-mistakes

• no-mistakes push/PR flow completed for JTInventory/firstmate after the local gate target was corrected from the upstream owner repo to the captain fork.
• PR body was updated through the GitHub REST API because gh pr edit hit GitHub's Projects classic deprecation error while updating an existing PR.