Establish canonical OpsTruth product knowledge base

[AyobamiH]

Summary

Establish the canonical anti-drift product knowledge layer for OpsTruth, while preserving its independent read-only verification boundary.

What changed

• add docs/KNOWLEDGE-BASE.md as an index over canonical sources rather than a second mutable status store
• freeze the product boundary: OpsTruth verifies evidence but does not implement, repair, deploy, merge, or mutate a target to manufacture success
• record exact-subject and fail-closed verification invariants
• reconcile the later DoneState 0.3.0 release at immutable commit 4ab47e099c3303d08565a7dbf4cda36bc68b74ce
• document the complete donestate.verification-contract.v2 path and production canary #114 outcome
• add kb:check to the normal CI path and lock the v2 boundary tokens against silent drift

DoneState 0.3.0 reconciliation

The September 4 release does not invalidate the September 3 adapter lesson. It adds stronger, canonical evidence:

• malformed verifier output is rejected
• a complete independent response must bind to the exact sealed subject
• DoneState cannot self-verify
• uncertain results remain AWAITING_VERIFICATION
• historical outcomes are not rewritten
• OpsTruth gains no write, merge, deploy, or repair authority

Canonical references:

• DoneState 0.3.0 release commit
• verification contract lock
• 0.3.0 release notes

Scope

Documentation and CI invariant checks only. No production deployment, target-repository mutation, authority expansion, or release-state claim.