feat(cognee): add local lookup manifest checker

[JTInventory]

Summary

Firstmate can now rehearse Cognee lookup locally without touching Cognee, MCP config, env files, or remote datasets. A dry-run wrapper treats answer text as hint_only by default, then upgrades only locally verified references to verified_local_source or stale_warning after manifest, checksum, path-risk, and source reopen checks pass.

The checker fails closed for missing citations, unknown manifest references, unsafe redaction status, risky source paths, bad size/checksum, and high/live stale-risk labels. Even verified local matches keep external_action_authorized=false, so memory output cannot become merge, deploy, cleanup, vendor, or customer authority.

Notes

• Manifest support is TSV-only in this first wrapper; JSONL can be added later if a real importer needs it.
• No Cognee API path is implemented. Running without --dry-run exits before any network or config access.
• Code review was a manual staged-diff review. The multi-agent CE review path was not used because this harness exposes sub-agents only when the user explicitly requests delegation.

Tests

• bash -n bin/*.sh tests/*.sh
• tests/fm-cognee-lookup.test.sh
• for t in tests/*.test.sh; do bash "$t"; done

Post-Deploy Monitoring & Validation

No additional production monitoring is required. This is local CLI plumbing only, with no daemon, network call, config mutation, or remote dataset mutation. Healthy validation is continued passing shell tests and local dry-run output that keeps unverified Cognee text labeled as hint_only.

---