feat(cognee): verify local source hints

[JTInventory]

Summary

Cognee hint text can now be checked against local evidence before Firstmate treats it as useful memory context. The verifier parses saved/redacted answer fixtures for SOURCE_ID, SOURCE_PATH, SEED_FILE, data UUIDs, and chunk UUIDs, then fails closed unless the local manifest row and reopened source file agree.

The verifier stays local-only. It does not call Cognee or any live API, and its output always keeps action_authorized: false so memory results cannot become approval for merges, deploys, cleanup, vendor actions, or other external work.

What Changed

• Added bin/fm-cognee-verify-source.sh, a local JSONL-manifest verifier that emits structured verification JSON.
• Added fixture-based shell coverage for verified local proof, manifest misses, checksum mismatch, raw-readback durability blockers, quoted paths with spaces, malformed UUIDs, unknown chunk IDs, and unreadable/non-UTF-8 answer files.

Tests

• bash tests/fm-cognee-source-verify.test.sh passed after the initial test-first red failure.
• bash -n bin/fm-cognee-verify-source.sh tests/fm-cognee-source-verify.test.sh passed.
• Full local shell suite passed twice with for t in tests/*.test.sh; do bash "$t"; done.

Caveats

• shellcheck is not installed in this environment, so shell lint was limited to bash -n and behavior tests.
• no-mistakes doctor was otherwise healthy, but the installed no-mistakes version reported an update warning (v1.30.1 -> v1.31.2).
• The first no-mistakes run found two valid auto-fix review items, which were applied manually and covered by tests: quoted paths with spaces and unreadable/non-UTF-8 answer files.
• A fresh no-mistakes run on the original branch hit a stale gate remote rejection after the interrupted auto-fix run left a branch in /root/.no-mistakes/repos/...; per direct-PR instruction, this PR uses the clean amended HEAD 07543de plus the passed focused/full shell tests as evidence.

Post-Deploy Monitoring & Validation

No additional operational monitoring required. This is a local-only CLI verifier with no live Cognee API calls, no daemon behavior, and no remote mutation path.

---

[JTInventory]

Superseded for the captain workflow by clean fork PR JTInventory#9, which has been merged into JTInventory/firstmate. Closing this upstream contribution because it is no longer the active delivery path.

[JTInventory]

Reopening to preserve this as an upstream contribution. The active delivery path for the captain fork is already merged at JTInventory#9.