feat: add deterministic KB release gates

[sergstack]

Summary

• Added deterministic KB release gate documentation and checker.
• Added CLI for governance/package/promotion checks.
• Added pytest coverage.
• Removed search CLI test dependency on ignored generated publish artifact.

Changed files

• CODEX.md
• README.md
• RUNBOOK.md
• docs/kb_release/**
• src/notes_to_kb/kb_release_gate.py
• scripts/check_kb_release_candidate.py
• tests/test_kb_release_gate.py
• tests/test_search_cli_mvp_10.py

Checks run

• python3 -m pytest tests/test_search_cli_mvp_10.py -q
• python3 -m pytest tests/test_kb_release_gate.py -q
• python3 scripts/check_kb_release_candidate.py --governance-dir docs/kb_release --scope governance-only --mode candidate --json
• python3 -m pytest tests -q
• git diff --check

Safety confirmation

• .env was not read or printed.
• input/** was not modified.
• workspace/** was not modified.
• publish/** was not modified.
• No LLM/Ollama/Gemini/network/pipeline refresh was run.
• No embeddings/vector DB/web UI was added.

Risks

• Real package promotion is not performed in this PR.
• Promotion validation is tested using tmp_path fixtures only.
• AGENTS.md still needs manual cleanup if active scope docs continue to mark it as needing cleanup.

Rollback

Revert this PR.

Acceptance status

pass