fix(knowledge): protect library imports and freeze 2.0 dependencies

[x-lixu]

Summary

• Reject new knowledge-library imports at capacity instead of silently dropping older index entries; still allow updates to existing text documents.
• Allocate import/conversion filenames against both the index and the filesystem, including unindexed retained copies, case-insensitive names and Unicode normalization. Protect new copy destinations against overwrite races.
• Reject rich-document ingestion at capacity before invoking the converter; cover completed-conversion adoption without duplicate files.
• Align the English/Chinese knowledge guides and security/privacy statements with current behavior and reviewed build-audit exceptions.
• Freeze routine npm and GitHub Actions Dependabot version updates for 2.0, without changing dependency manifests or lockfiles. Security updates remain eligible; restoration limits are documented in the config.

Validation

• npm run release:check: passed (3,107 tests passed, 20 skipped, 0 failed); dependency audit, lint, production build and npm package verification passed.
• Focused knowledge suites: 47 passed, 0 failed.
• npm run docs:build: passed; links and anchors checked across 125 pages.
• git diff --check: passed; Dependabot YAML parsed and both routine PR limits verified as zero.

The first local release-check attempt overlapped with docs generation and saw an ESLint ENOENT for a temporary VitePress build file. The complete release check was rerun serially after docs generation and passed without exemptions.

Release scope

No version bump, dependency upgrade, root README change, release tag, or package publication. This is release preparation only; the Dependabot freeze takes effect after merging. Existing dependency PRs #489 and #490 remain open for post-release review and are not part of this merge.

Issue/PR housekeeping was performed separately on GitHub: superseded PRs #470–473 were closed; #320, #333, #334, #431, #230, #231 and #131 were triaged against current main. This PR does not imply that remaining mobile field acceptance or PR #418 has been completed.

[x-lixu]

CI follow-up (first attempt, run 35608600815):

• Knowledge regressions, release checks, docs, all Linux jobs, Windows Node 22, and macOS Node 24 passed.
• Windows Node 24 reported a child-process failure in unchanged server/test/webrtc-client-actions.test.mjs, without an assertion or stack trace. This resembles the unresolved [Bug] windows-latest 偶发 "test failed" 且无诊断信息（测试文件子进程静默非零退出） #413 signature; its root cause is not established. The focused suite passes locally (5/5).
• macOS Node 22 hit the desktop smoke test's 20-second timeout while stdout still reported Downloading Electron binary.... The same desktop smoke test passes locally.

Requested one manual rerun of failed CI jobs. No tests, assertions, or workflow gates were weakened or skipped. Merge remains conditional on all checks passing.