feat(knowledge): stage/delete knowledge pack task handlers

[ysyneu]

Summary

Adds two WebSocket task handlers so the runner can receive knowledge-pack files pushed from Safari at session start and remove them on demand. Implements the Safari-side contract in fc-safari:docs/knowledge-runner-tasks.md.

• stage_knowledge_files — decodes each {rel_path, checksum, content_b64}, writes atomically (temp + rename), then merges entries into <workspace>/.safari-knowledge-sentinel.json under an advisory lock (flock) to handle concurrent BYOC sessions.
• delete_knowledge_files — unlinks each rel_path (idempotent) and removes its sentinel entry under the same lock.
• Path validation rejects /, \\, .., dotfiles (including the sentinel name itself — the runner owns the sentinel, clients don't stage it).
• 14 subtests cover single-file stage, overwrite, mixed-validity, stage+delete cycles, missing-path idempotency, and the path-rejection matrix.

Context

Safari's EnvironmentMiddleware.BeforeModelCall lazy-stages the account's knowledge pack into the runner's workspace root so DUTY.md and @-referenced runbooks survive across sessions and ephemeral cloud pod restarts. Without these handlers the Safari end dispatches the tasks but the runner ignores them, and the agent sees an empty workspace.

Test plan

• Unit: go test ./workspace/ -run \"TestStage|TestDelete|TestValidate\" -v — 14/14 PASS.
• Integration with Safari: attach a rebuilt runner to a Safari session, save a file via Settings → Knowledge Packs, start a new session, confirm the file appears at workspace root.
• Concurrent sessions on BYOC: two sessions on the same runner concurrently trigger stage — sentinel stays consistent.

🤖 Generated with Claude Code