feat(kb): brain tools, Go async serve, root-level docker

- tools/kblib.py: ladybug schema, embeddings, FTS+vector, hybrid RRF
- bin/kb/{index,search,get,stats,eval}: corpus indexing + deduction search
- bin/facts/{extract,audit}: 2-source evidence acquisition + gates
- serve/: async Go HTTP server (goroutines, bounded worker pool), TDD
- docker/ flattened to root: compose.yaml + Dockerfile (multi-stage Go)
- docker scripts -> bin/ shebang pattern (kb-watch, docker-entrypoint)
- bin/ci/semver + tools/semver.py: conventional-commit semver release
- ci.yml: go tests + shell checks; drop release-please (PR toggle blocked)

bin/docker-entrypoint

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# bin/docker-entrypoint - run 2dph tools inside the container.
+#
+#   brain                 shell (default)
+#   brain search <q>      bin/kb/search
+#   brain index           bin/kb/index
+#   brain watch <dir>     watchdog re-indexer
+#   brain serve           async Go HTTP server (serve/)
+#
+# Usage comment starts at line 2 (self-describing convention).
+set -euo pipefail
+
+CMD="${1:-shell}"
+shift || true
+
+case "$CMD" in
+  shell) exec bash ;;
+  search) exec "$KB_PY" /app/bin/kb/search "$@" ;;
+  index) exec "$KB_PY" /app/bin/kb/index "$@" ;;
+  watch) exec bash /app/bin/kb-watch "$@" ;;
+  serve) exec /app/serve/serve "$@" ;;
+  *) echo "unknown command: $CMD" >&2; exit 2 ;;
+esac