[ADR-034] kkernel Engine and Admin Commands

[ohdearquant]

Summary

Add CLI command groups for validation, engine status/migration/drift checks, vector capability/sweep operators, and config wiring over the coordinator/runtime surfaces.

Source ADRs

• F192 ADR-034 (MAJ): kkernel exposes only sync and pack; there is no kg validate, kg init, kg hook, validation output mode, strict/no-rules flag, rules path override, or fix command path. (from audit-rest/r3/ADR-034.md)
• F194 ADR-035 (CRIT): kkernel has only top-level sync and pack commands. (from audit-rest/r5/ADR-035.md)
• F229 ADR-043 (MAJ): The CLI has only sync and pack; no khive engine list/status/migrate/drift-check command group exists. (from audit-rest/r5/ADR-043.md)
• F236 ADR-044 (MAJ): CLI subcommands are only sync and pack; no vector capability or sweep operator commands are present. (from audit-rest/r1/ADR-044.md)

Files affected

• crates/kkernel/src/main.rs (167 sampled LOC)
• crates/kkernel/src/config.rs (new/planned path)
• crates/kkernel/src/lib.rs (28 sampled LOC)
• crates/khive-runtime/src/runtime.rs (388 sampled LOC)
• crates/khive-mcp/src/main.rs (82 sampled LOC)

Acceptance criteria

• All source findings listed above are addressed exactly once in this cluster.
• Public types, handlers, schema, and docs touched by the affected files agree on the ADR contract.
• Regression tests cover happy path and edge cases for the changed public APIs or schema behavior.
• cargo test -p kkernel passes.
• cargo clippy --workspace -- -D warnings passes.
• make ci passes.

Dependencies

• Depends on: #[ADR-007] Namespace Token and Runtime API Migration
• Depends on: #[ADR-003] Runtime Backend and Substrate Coordinator
• Depends on: #[ADR-010] VCS Git-Native Core and Legacy Removal
• Depends on: #[ADR-023] Dynamic Pack Loading, Template, and Pack Binary Inclusion
• Depends on: #[ADR-011] Retrieval, Embed, and Lattice Boundary
• Blocks: #[ADR-035] Import, Export, Remote Resolver, and Sync

LOC estimate

~180 lines added/50 removed; 4 existing affected file(s) sampled at 665 current LOC via wc -l, plus 1 new/planned path(s).

Risk notes

• Same-file dependencies must merge first; dependency list includes the exact overlapping paths.
• 1 affected path(s) are new/planned and were not present in rg --files --hidden; create them in the owning PR rather than in independent parallel work.
• Contains CRIT findings; do not defer without owner approval.

Auto-generated by ADR alignment triage

[ohdearquant]

Landed in main via PR #349 (integration of cluster c21 — original cluster PR was #371). Tracker complete.