feat: propagate trust signals (confidence/provenance/review-state) into retrieval + MCP output

[rajnavakoti]

Part of #82 (calibrated honesty). This is the one that actually protects the consuming agent — without it, confidence/provenance/review-state are invisible to consumers.

Problem

Even with calibrated confidence (#83), provenance (#84), and review-state, retrieval and the MCP server currently return entity content with no trust signals. So a consuming agent (e.g. Copilot via MCP) reads "pickup-point-manager is a domain" and believes it — it has no way to say "the KB is unsure / this is unverified / asserted from a single doc."

Goal

Retrieval results and MCP tool responses carry the trust signals, so the consuming agent can hedge, verify, or down-weight low-trust knowledge.

Acceptance Criteria

• ask / retrieval results include per-entity confidence, corroboration/provenance, and review_state
• MCP tools (get_entity, get_full_entity/feat: richer MCP tool surface — get_full_entity + progressive disclosure for agents #75, search, ask_kb) return the same trust signals in their payloads
• Synthesis/answers can flag low-trust content (e.g. "this is unverified / single-source") rather than stating it as fact
• Tool descriptions instruct the agent to hedge on low-confidence / unreviewed / uncorroborated content
• Tests: a low-confidence, unreviewed, single-source entity surfaces its trust signals through retrieval and MCP

Out of scope

• Generating the signals themselves (feat: calibrated entity/relationship confidence (fix uniform 0.9 self-ratings) #83/feat: provenance — track source corroboration per entity + relationship #84/review-state) — this propagates them.