feat(validation): independent validation that certifies items into validated knowledge

[JulioMCruz]

Deepens the validated-knowledge rail: makes "validated" mean independently validated, and makes validation actually produce validated knowledge.

The gaps this closes

1. Validation never reached the items. The provider flow (claim → fulfill → validate) updated knowledge_requests but never touched research_items, so the only path to a validation_status=validated item was a manual admin action. The validated_only/enterprise tier had nothing provider-validated to return.
2. No independence. validate only checked the caller was an active agent — not that it differed from the fulfiller/contributor. With the ingest token, a provider could self-validate; the quality rubric literally says "not independently validated" but nothing enforced it.

What ships

lib/validation.ts (shared, unit-tested):

• assertValidatorIndependent — rejects when the validator is the request’s fulfiller or a contributor of the items (validator_is_the_fulfiller / validator_is_a_contributor).
• certifyResearchItems — recomputes the quality rubric and promotes each fulfillment item to validated only when it clears the enterprise floor (≥70); weaker items stay pending with a reason (a thumbs-up can’t launder a thin item). Logs a contributor_quality_events row. Mirrors /api/admin/quality.

validate route now enforces independence and certifies the fulfillment items on accept, returning { certified, certifiedCount }.

Contract — llms.txt + skill manifest document the independence rule.

Tests

+8 unit tests (independence branches + certify strong→validated / thin→pending). Full suite 217 pass. No tsc errors outside pre-existing test files.