refactor: extract kb_framework package, build graph in memory

Scripts become thin CLIs over kb_framework (graph, query, query_tools,
vault, instructions) so the hosted read-only connector shares one
implementation with the stdio server. The MCP server builds the graph
from Markdown on demand and invalidates it on writes; refresh_graph
rebuilds in memory and reports validation problems. Pre-commit hook
validates only; index/graph.json is no longer read, written or staged
(generate-graph.py --write remains for operators). Golden fixtures pin
graph and tool payloads to the previous output. Agent and skill docs
updated to match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/test_generate_graph.py

@@ -63,12 +63,7 @@ class TestValidateExitCode(unittest.TestCase):
     def setUp(self) -> None:
         self._tmp = tempfile.TemporaryDirectory()
         self.root = Path(self._tmp.name).resolve() / "vault"
-        (self.root / "scripts").mkdir(parents=True)
-        (self.root / "03_resources").mkdir()
-        for name in ("generate-graph.py", "vault_root.py"):
-            (self.root / "scripts" / name).write_text(
-                (SCRIPTS / name).read_text(encoding="utf-8"), encoding="utf-8",
-            )
+        (self.root / "03_resources").mkdir(parents=True)
 
     def tearDown(self) -> None:
         self._tmp.cleanup()
@@ -81,7 +76,7 @@ class TestValidateExitCode(unittest.TestCase):
 
     def validate(self) -> subprocess.CompletedProcess:
         return subprocess.run(
-            [sys.executable, "scripts/generate-graph.py", "--validate"],
+            [sys.executable, str(SCRIPTS / "generate-graph.py"), "--vault-root", str(self.root), "--validate"],
             cwd=self.root,
             capture_output=True,
             text=True,