fix: bind guarded writer to supplied env

[andrei-hasna]

KNO-00017

Fix-on-sight implementation for Todos task 42ff144c-35f4-45dd-a3b8-a383d9c13fcb.

Summary:

• Add a regression proving createKnowledgeGuardedWriter({ env }) uses the supplied API URL and x-api-key when ambient credentials differ.
• Bind guarded transport resolution to the supplied env by removing broader ambient profile/override/HOME disk credential tiers on the guarded path only.
• Preserve FCAME-1 fail-closed behavior: no local JSON/SQLite/raw-store fallback, no uncertain mutation retry changes.

Validation captured locally:

• Red regression before fix: expected supplied synthetic key, received ambient synthetic key; rc 1.
• Focused regression after fix: 13 pass, 0 fail; rc 0.
• Typecheck: bunx tsc --noEmit; rc 0.
• Build: bun run build; rc 0.
• Full tests: 439 pass, 2 skip, 0 fail; rc 0.
• Contracts conformance: rc 0.
• No-cloud scan: rc 0.
• Public package validation and package-release test: rc 0.
• Generated verification after commit: 6 generated bundles rebuild byte-identically; rc 0.
• Staged scanner before commit reported one generated-file false positive on an unchanged dist/index.js version env-name; the exact staged diff did not contain that env name. Clean-index staged scan before push: findingCount 0; rc 0.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

GO — fixed independent adversarial review for exact candidate 6851f8a112af38adca3964a60cc71990f068934f against base 98ed2288ef4b59b98365c7b842e240b306e05f6c.

Acceptance reviewed:

• createKnowledgeGuardedWriter({ env }) now resolves the guarded transport from a sanitized copy of the caller-supplied env: HOME/USERPROFILE/HASNA_PROFILE/HASNA_KNOWLEDGE_API_KEY_OVERRIDE are stripped only for the guarded path, so ambient disk/profile/override credentials cannot outrank the supplied API URL/key.
• FCAME-1 fail-closed behavior remains: guarded writer construction still refuses without authenticated HTTP transport; submit/reconcile/readback still set retry: false; no local/raw fallback was reintroduced.
• Ordinary public SDK/CLI credential resolution remains unchanged; direct smoke preserved disk-tier-over-env behavior for resolveKnowledgeCloudStore.
• No concrete currently reachable in-scope P0/P1 defect found for the stated gates, credential safety, data integrity, or compatibility.

Literal gate output lines:

$ git rev-parse HEAD
6851f8a112af38adca3964a60cc71990f068934f
$ git merge-base HEAD origin/main
98ed2288ef4b59b98365c7b842e240b306e05f6c
$ git status --short --branch
## review-pr-76-6851f8a

$ bun test tests/guarded-writer.test.ts
(pass) REGRESSION: guarded writer uses the supplied env endpoint and credential, not ambient credentials [4.08ms]
 13 pass
 0 fail
Ran 13 tests across 1 file. [1469.00ms]

$ bun test
 439 pass
 2 skip
 0 fail
Ran 441 tests across 49 files. [106.65s]

$ bunx tsc -p tsconfig.build.json
Resolving dependencies
Resolved, downloaded and extracted [2]
Saved lockfile

$ bun run verify:generated
verify-generated-artifacts: 6 generated bundles rebuild byte-identically and carry no stale generated code.

$ bun run contracts:conformance
ok invalid hasna.project_panel.v1 fixtures/project-panel.invalid.json
ok valid hasna.project_panel.v1 fixtures/project-panel.valid.json

$ contracts no-cloud-scan .
ok hasna.no_cloud_evidence_pack.v1 .

$ bun run build
  knowledge.js  1.0 MB  (entry point)
  knowledge-mcp.js  1.27 MB  (entry point)
  knowledge-serve.js  131.14 KB  (entry point)
  index.js    1.71 MB    (entry point)
  storage.js  128.11 KB  (entry point)
  serve.js    156.98 KB  (entry point)

$ node scripts/validate-public-package.mjs
Public package validation passed for hasna-knowledge-0.2.96.tgz.
Public docs included: 8.
Public scripts included: 7.

$ bun --eval '<public SDK credential smoke>'
public-sdk-credential-resolution: disk-tier-preserved

$ gh pr checks 76 --repo hasna/knowledge
test (macos-latest, bun)	pass	58s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831293
test (macos-latest, node)	pass	1m5s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831278
test (ubuntu-latest, bun)	pass	1m32s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831294
test (ubuntu-latest, node)	pass	1m23s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831295
test-matrix (macos-latest, bun)	pass	1m7s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831309
test-matrix (ubuntu-latest, bun)	pass	1m7s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831301
test-matrix (windows-latest, bun)	pass	4m2s	https://github.com/hasna/knowledge/actions/runs/31249237112/job/93082831287