refactor(tools): bin/{subject}/{method} layout; Go serve+watch modules

Move serve/ (module) -> bin/server, tools/ -> bin/tools, replace bin/kb-watch
bash with bin/watch Go package; self-executing Go shebangs bin/serve.go and
bin/kb/watch.go; Docker + CI + git/import + docs repointed. Multi-stage image
builds static serve+watch binaries (no Go runtime in container).

.github/workflows/ci.yml

@@ -31,18 +31,16 @@ jobs:
         run: |
           bash -n bin/db/psql-yq
           bash -n bin/db/ssh-tunnel
-          bash -n bin/kb-watch
           bash -n bin/docker-entrypoint
 
       - name: Python unit tests (offline, vendored tools)
         run: |
-          uv run python -m unittest discover -s tools -t .
+          uv run python -m unittest discover -s bin/tools -t .
 
-      - name: Go serve tests (async, goroutine-bounded)
+      - name: Go tests (server + watch packages)
         run: |
           go vet ./...
           go test ./... -count=1
-        working-directory: serve
 
       - name: facts/audit self (lexicon consistency, no network)
         run: |