feat(issue-430): project RIE knowledge and guard evidence

[James3014]

Closes #430.

Current-main requalification of the accepted #430 implementation. This PR projects the canonical Repository Intelligence knowledge and guard-delta operations as read-only DevSpace MCP tools.

The delta is intentionally bounded to:

• src/repository-intelligence.ts
• src/server.ts
• src/repository-intelligence.test.ts

It reuses the existing RIE runner and server registration path:

• extends the operation/tool-name union;
• preserves exact RIE top-level and nested claim ceilings;
• fails closed on missing/wrong claim ceilings for the two new hash-bound reports;
• registers both tools with the existing read-only/non-destructive/idempotent annotations;
• forwards normalized evidence unchanged to the canonical RIE CLI;
• adds no Nexus governance, mutation admission, approval, merge, release, dispatch, or policy authority.

RIE prerequisite:

• RIE fix: bind dispatch to fresh catalogs and verified provider results #60 current/merged revision: 88285acf570688befbc8e36eb73f46987171bd4e
• canonical operations: knowledge, guard-delta

Current-base lineage:

• base: 0b7c8e0387cc3f02a358eb2693f7a03783e04205
• candidate: e4b9daa04f8f18dda7ea40d22dc351b0eb4e49ab
• tree: 2504404b1d5b43be2832de09431a08e50f422900
• supersedes stale-base PR feat(issue-430): project RIE knowledge and guard evidence #437.

Local current-base verification:

• git diff --check: PASS
• tsx src/repository-intelligence.test.ts: 4/4 PASS
• npm run typecheck: PASS

Owner verifier exception

The Owner explicitly instructed to skip the independent reviewer gate after repeated verifier-transport failures. This is not recorded as reviewer PASS or independent Candidate acceptance. Completion still requires exact-head CI/Core/RI checks, merge, canonical runtime cutover, live MCP canaries for both new tools, and negative #413 governance-tool canaries.

Claim ceiling: DEVSPACE_RIE_READ_ONLY_ADVISORY_PROJECTION_ONLY.