feat(agent): add online verification and governing-answer citations

Claim-bound online verification observations with URL provenance, exact
answer-basis references for citation-free governing-rule answers, and an
explicit operator identity handoff before source transfer. Bounds resumed
work by learning unit and refreshes pack manifest/contracts.

skills/kb-query/SKILL.md

@@ -4,9 +4,9 @@ description: Search and explain accepted GEWU knowledge within an explicit proje
 ---
 # Query accepted knowledge
 
-Read the pack's [evidence](../../protocols/EVIDENCE.md) and [scope](../../protocols/SCOPE.md) protocols, then use the [query pipeline](../../pipelines/query.md). Consult [contributions](../../protocols/CONTRIBUTIONS.md) for connection/availability rules; this skill performs no knowledge writes.
+Read the pack's [evidence](../../protocols/EVIDENCE.md) and [scope](../../protocols/SCOPE.md) protocols, then use the [query pipeline](../../pipelines/query.md). Consult [contributions](../../protocols/CONTRIBUTIONS.md) for connection/availability rules and [online verification](../../protocols/ONLINE_VERIFICATION.md) when a fresh check is requested; report stored checks distinctly from unpersisted observations.
 
-Establish the question, scope and response budget. Use supported search/read tools and inspect the sources behind the strongest results. Use `list_sources` to browse the archived source catalog within that same authorized scope. Narrow searches with node-type or past-freshness filters when they match the question; filters do not widen authorization scope. Preserve complete citation groups and required warnings. Widen scope only through an explicit request consistent with the user's task.
+Establish the question, scope and response budget. For ordinary bounded retrieval, set `include_evidence=false`: search returns compact claim summaries with per-claim `evidence_count` and omits quote payloads. For the strongest results, call the canonical node read to get the complete claim-to-citation groups and inspect the source passages. Set `include_evidence=true` when a full citation-bearing search response is needed and the budget permits it; this is also the API default for compatibility. Use `list_sources` to browse the archived source catalog within that same authorized scope. Narrow searches with node-type or past-freshness filters when they match the question; filters do not widen authorization scope. Preserve complete citation groups and required warnings in the final answer. Widen scope only through an explicit request consistent with the user's task.
 
 Separate accepted relationships from suggestions and distinguish disagreement from missing evidence. Answer with relevant conditions, as-of dates and source references near the claim. If retrieval is degraded, index-lagged or insufficient, state the observed limitation. Do not present a local draft, model recollection or unavailable service as an accepted GEWU result.