feat: add governed public knowledge retrieval

tests/unit/core/test_security.py

@@ -53,7 +53,7 @@ def test_authenticate_visitor_token_returns_limited_anonymous_context() -> None:
     context = JwtAuthenticator(_settings()).authenticate(token)
 
     assert context.roles == ("visitor",)
-    assert context.permissions == ("agent:run",)
+    assert context.permissions == ("agent:run", "knowledge:query")
     assert context.customer_ids == ()
     assert context.data_scope == "public"
 
@@ -64,7 +64,7 @@ def test_visitor_token_issuer_creates_short_lived_limited_token() -> None:
     context = JwtAuthenticator(_settings()).authenticate(token)
 
     assert context.roles == ("visitor",)
-    assert context.permissions == ("agent:run",)
+    assert context.permissions == ("agent:run", "knowledge:query")
     assert expires_at > datetime.now(UTC)