feat(audit): read-only knowledge-graph drift report + skill

Adds audit_knowledge_graph (MCP tool) and GET /api/v1/audit/drift (endpoint)
backed by a shared internal/audit package. One pass surfaces the structural
gaps an operator otherwise finds by accident: orphan check entities, checks
targeting deprecated/destroyed entities, probes stuck down/unknown, unmonitored
declared types, and live edges pointing at destroyed targets. Each finding
carries a suggested remediation runbook. Read-only and safe to run unattended.

Ships the knowledge-graph-audit skill (SKILL.md + seeded runbook) that
interprets the report and routes findings to the lifecycle runbooks.

seeds/knowledge.yaml

@@ -6372,6 +6372,23 @@ investigations:
   tags:
   - investigation
 runbooks:
+- slug: knowledge-graph-audit
+  name: Knowledge-graph audit
+  risk_class: read_only
+  entity_type: entity
+  procedure: {}
+  content: "---\nname: knowledge-graph-audit\nrisk_class: read_only\ninputs: []\nverification:\
+    \ \"audit_knowledge_graph returns a report with summary.total_findings\"\ndocs_update_checklist:\
+    \ []\n---\n\n# Knowledge-graph audit\n\nRead-only validation that the knowledge graph\
+    \ and its monitoring reflect reality.\nCall MCP `audit_knowledge_graph` (or `GET /api/v1/audit/drift`)\
+    \ for a ranked report:\norphan check entities, checks on deprecated/destroyed targets,\
+    \ probes stuck down/unknown, unmonitored declared types, and dangling edges. Each\
+    \ finding carries a `suggested_runbook`. Triage critical (down_checks) first; confirm\
+    \ each with `get_entity`/`get_relations` before acting. This skill makes no changes\
+    \ \u2014 route confirmed findings to their remediation runbook and re-run the audit\
+    \ to verify. Live-infra discovery (pct/docker/certs vs DB, misplaced parents, undeployed\
+    \ scripts, unmodeled certs, seed drift via `oikos export`) is a documented manual\
+    \ follow-up until that machinery lands.\n"
 - slug: client-enrollment
   name: Client enrollment
   risk_class: read_only