Add read-only Cognee live lookup

[JTInventory]

Summary

• add guarded live mode to fm-cognee-lookup.sh using only exported Cognee env vars and POST /api/v1/search
• keep Cognee output hint-only, require local manifest/source verification before verified status, and record secret-safe telemetry with external_action_authorized=false
• tighten Markdown/source parsing and prevent generic SEED_FILE=report.md from becoming proof

Tests

• tests/fm-cognee-lookup.test.sh
• tests/fm-memory-lookup.test.sh
• bash tests/fm-cognee-source-verify.test.sh
• tests/fm-cognee-telemetry.test.sh
• bash -n touched Cognee scripts/tests
• git diff --check

Supersedes #15. Do not merge without captain approval.