fix(cli): tree-canonical range hash for CI verify

[chtnnh]

Summary

• Make range hashing tree-canonical (fromOid^{tree} → write-tree) so pass-time trailers match CI after know-code commit without trusting gitignored seals.
• Pin know-code CI/init workflow to the PR tip (head.sha), write requireTrailer: true, and add npm run smoke:verify (CI-shaped e2e).
• Document the verify contract in website/docs/verify.md; tighten ci.md / how-it-works.md.

Closes #8

Test plan

• npm test
• npm run smoke
• npm run smoke:verify
• Confirm GitHub know-code check is green on this PR (tip trailer = merge-base..HEAD)

[cursor]

PR Summary

Medium Risk
Changes core hash and verify semantics used by gates and CI; incorrect hashing would break enforcement, but coverage includes gate-drift, verify, git-env lock tests, and CI-shaped smoke.

Overview
Range and index hashing now derive from lock-safe indexTreeOid and a tree-canonical range formula (fromOid^{tree} → current index tree) instead of cumulative commit diffs plus staged patches. The same gated tree keeps the same hash after know-code commit, so CI can validate Know-Code-Verified from public git alone—local commit-drift is no longer the happy path for multi-commit batches.

CI and tooling: GitHub workflows and know-code init --workflow check out github.event.pull_request.head.sha (merge commits lack trailers). The monorepo know-code job writes requireTrailer: true, adds npm run smoke:verify (scripts/smoke-verify-ci.sh strips gitignored seals then runs verify), and documents the contract in website/docs/verify.md with updates to CI/how-it-works/workflows. The CLI also exposes a kc bin alias.

^{Reviewed by Cursor Bugbot for commit a5102df. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9e1f785. Configure here.}