Add the kb-gate verifier, its pinned bundle and workflow

.github/CODEOWNERS

@@ -0,0 +1,18 @@
+# Knowledge maintainers own the knowledge gate: its verifier bundle, workflows,
+# signing key and this file, plus the knowledge tooling and the non-governed
+# knowledge paths. With the ruleset's "require review from Code Owners" and
+# "dismiss stale approvals", a change here cannot land without a maintainer
+# approving its current head (doc/features/knowledge-service.md).
+#
+# Governed knowledge pages (knowledge/repos/**, knowledge/general/**) have NO
+# code owner on purpose: they merge through the kb-gate signed verdict. A
+# human-approved verdict must be approved by an owner of /.github/kb-gate/.
+#
+# GitHub does not let an author approve their own PR, and knowledge PRs are
+# opened as @tzhouam, so at least one more maintainer must be listed below
+# before the human-approved path can be used (owner setup step).
+
+/.github/                 @tzhouam
+/knowledge/tools/         @tzhouam
+/knowledge/skills/        @tzhouam
+/knowledge/.claude/       @tzhouam

.github/kb-gate/MANIFEST.sha256

@@ -0,0 +1,9 @@
+5f6e269fbbb951f9a49c40474a3d71c556ac389f5ebd5545f0ac762f85361723  README.md
+77d88b9671927ab95bc6ac9ed57aaa24226423e151843381c2a3fa90cd0cafde  config.json
+e8157d90270e9f437b364e9ef95bc0603c80c6421fa591953525387cc4f5d4e0  kb_gate.py
+5743c4a6943c291073c5344d408eaec28e8bc7440a8ee113365588728ded5e8a  l1.py
+39f69aa816b83b673443601d38e57040521664c5aca407154ba40a8a35bc61d9  lifecycle.py
+b0d0fab0210870f989da80f7ffba3978dbf723f4f087025524d1963c4081a009  ops.py
+67f2ebd85e4e886f3facc35a181f575fd6291f1e4a4068f5daca99191609aace  requirements.lock
+e7fbe6f3d6b02fadfbd86e32e67d588ae698ae2de19ac91aa5db2a250cb93946  signing.py
+5c5015e7e9e6314f84e0337a58d9aa1bb6f7ec21ec830e4907dc5c35bbca4a09  verdict.py

.github/kb-gate/README.md

@@ -0,0 +1,23 @@
+# kb-gate verifier bundle
+
+The required check `kb-gate` runs **only** from this directory. It is generated by
+`tools/build_kb_gate_bundle.py` from `src/infermatrix_copilot/knowledge_service/`
+(`gate_verifier.py` → `kb_gate.py`, plus `l1`, `lifecycle`, `ops`, `signing`,
+`verdict`); do not edit the `.py` files here by hand. The job installs
+`requirements.lock` with `--require-hashes --no-deps` and checks `MANIFEST.sha256`
+before running anything.
+
+Changing anything here is a `.github/**` change and needs CODEOWNERS approval, so a
+code PR that weakens `src/` or `knowledge/tools/` cannot weaken the gate.
+
+`config.json`:
+
+- `holds_url`: the public HTTPS URL of the knowledge service's signed hold list
+  (`<state_dir>/public/holds.json` on the bot host). Until it is set, every PR that
+  touches `knowledge/` fails closed. PRs that do not touch `knowledge/` always pass.
+
+The service's public key is `.github/kb-gate.pub` (`ed25519 <base64>`, the output of
+`kb keygen`). Without it, every knowledge PR fails closed.
+
+See `doc/features/knowledge-service.md` for the stages (PR precheck and merge group)
+and what each checks.

.github/kb-gate/config.json

@@ -0,0 +1,3 @@
+{
+  "holds_url": ""
+}