Follow-ups from #261: KB version-check deferrals (multi-registry, git source, downgrade URL, e2e)

[rucka]

Deferred minor findings from the independent review of #261 (PR #290), consciously accepted at merge as follow-ups:

1. Multi-registry version reporting — Business Rule "version reported per registry where applicable" is unimplemented. The single .pair/.kb-version.json marker + resolveCurrentVersion operate at dataset granularity; RegistryConfig has no version field. Multi-registry projects get one aggregate version.
2. Git-source version check — version-resolver.ts returns current-unavailable for git sources ("not supported yet"). Git-backed KBs can never report a current version.
3. Downgrade migration URL — buildMigrationUrl(installed, current) produces a reversed (non-existent) docs URL when installed is newer than current (downgrade). Needs a semver-aware guard (no comparator exists yet) or fall back to the migrations index. Out of CLI KB version check: installed vs current + migration pointer #261 AC1 scope (upgrade only).
4. Round-trip e2e — DoD "install old fixture → drift → update → clean" is verified in isolated tests, not a single chained end-to-end test.

Source: PR #290 review (orchestrator, 2026-07-11).

[rucka]

Update: finding 3 (downgrade migration URL) has been resolved in #261 (commit 9938c83) — the migration URL is now built only on a genuine upgrade. Remaining deferred items: 1 (multi-registry version), 2 (git-source version check), 4 (round-trip e2e). (The asymmetric pre-release label, a separate finding, was also fixed in #261.)