feat(search): provenance 출처 필터 — [[workspace.sources]] 멀티소스 + --source/--source-type

혼합 출처 KB(위키+jira 등)에서 색인은 전부 하되 질의 시 출처로 좁히는 provenance
레버. 전역 trust 곱셈가중(weighted-RRF)은 A/B 에서 반증(θ=0.85 만으로 incident MRR
0.918→0.340 절벽, 점수 압축) — 필터가 see-saw 없는 올바른 레버.

- config [[workspace.sources]] (각 id/root/exclude/trust_level/source_type);
  단일 root 는 implicit `default` source 로 정규화. validate: id 유일·비어있지 않음.
- config schema v3→v4 (step_3_to_4, root→[[workspace.sources]] id=default 미러, 멱등)
- V014 documents.source_id 컬럼+인덱스 (additive, DEFAULT 'default', 재색인 0)
- Metadata.source_id + BodyHints trust precedence(frontmatter > source 기본값 > Primary)
- ingest: --root 미지정 시 resolved_sources() 순회 + doc 마다 source_id/trust stamp
- 검색 SearchFilters.source_type/source_id → lexical + vector 두 site (IN, OR)
- CLI kebab search --source <id> / --source-type <type> (repeatable/comma-sep)

도그푸딩(620 doc, jira400+wiki220): --source wiki 로 개념 질의 MRR 0.780→0.810,
--source jira 로 incident 0.918→0.975. trust precedence 실측(jira=secondary 기본값).

version bump 0.28.0 → 0.29.0 (신규 CLI flag + config 키 + V014 migration → minor).
follow-up: MCP search 필터 미노출 · kebab list source_id 미표시 · RAG provenance 라벨.

자세한 내용: tasks/HOTFIXES.md (2026-06-21), docs/release-notes/v0.29.0-draft.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Mc6W1fgsrbFKTsqA6P8La

Cargo.lock

@@ -4751,7 +4751,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-app"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -4799,7 +4799,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-chunk"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -4817,7 +4817,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-cli"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -4838,7 +4838,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-config"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "dirs 5.0.1",
@@ -4854,7 +4854,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-core"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -4868,7 +4868,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-embed"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -4882,7 +4882,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-embed-candle"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "candle-core",
@@ -4902,7 +4902,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-embed-local"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "fastembed",
@@ -4915,7 +4915,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-embed-ollama"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "kebab-config",
@@ -4930,7 +4930,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-eval"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "kebab-app",
@@ -4949,7 +4949,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-llm"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "kebab-core",
@@ -4958,7 +4958,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-llm-local"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "kebab-config",
@@ -4975,7 +4975,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-mcp"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "kebab-app",
@@ -4993,7 +4993,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-nli"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "hf-hub",
@@ -5008,7 +5008,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-parse-code"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "gix",
@@ -5031,7 +5031,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-parse-image"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "ab_glyph",
  "anyhow",
@@ -5059,7 +5059,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-parse-md"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "kebab-core",
@@ -5076,7 +5076,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-parse-pdf"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -5091,7 +5091,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-rag"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -5113,7 +5113,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-search"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "globset",
@@ -5132,7 +5132,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-source-fs"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -5150,7 +5150,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-store-sqlite"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -5170,7 +5170,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-store-vector"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "arrow",
@@ -5194,7 +5194,7 @@ dependencies = [
 
 [[package]]
 name = "kebab-tui"
-version = "0.28.0"
+version = "0.29.0"
 dependencies = [
  "anyhow",
  "crossterm",