build(ci): uv toolchain, release-please semver; feat(skills): vendor tools self-contained (no symlinks, relative refs)

- bin/db/psql-yq + bin/web/search + tools/{yamlout,websearch} vendored as real files
- bin/db/ssh-tunnel added (OnlyOffice VM pg on 5433)
- skills reference local bin/ paths; no agent-skills/abs links in git
- pyproject.toml + uv.lock; CI installs via uv sync --frozen
- release-please auto-tags semver from conventional commits when green
- LICENSE MIT, badges/mermaid README

docker/kb-watch

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# kb-watch - re-index 2dph when corpus files change.
+#
+#   kb-watch [dir...] [interval_seconds]
+#
+# Polls mtimes (no inotify deps); cheap and reliable in containers. Defaults:
+# dirs = /corpus (compose) or . ; interval = 30s.
+set -euo pipefail
+
+DEFAULT_DIRS="${KB_WATCH_DIRS:-/corpus}"
+DIRS=("$@")
+[[ ${#DIRS[@]} -eq 0 ]] && DIRS=(${DEFAULT_DIRS})
+INTERVAL="${KB_WATCH_INTERVAL:-30}"
+
+index() { python3 /app/bin/kb/index; }
+
+LAST_STAMP=""
+while true; do
+  STAMP=$(find "${DIRS[@]}" -type f -newermt "-${INTERVAL} seconds" 2>/dev/null \
+    | head -1 | md5sum)
+  if [[ -n "$STAMP" && "$STAMP" != "$LAST_STAMP" ]]; then
+    echo "kb-watch: changes detected, re-indexing" >&2
+    index || echo "kb-watch: index failed; will retry" >&2
+    LAST_STAMP="$STAMP"
+  fi
+  sleep "$INTERVAL"
+done