feat(search): provenance 출처 필터 — [[workspace.sources]] 멀티소스 + --source/--source-type

혼합 출처 KB(위키+jira 등)에서 색인은 전부 하되 질의 시 출처로 좁히는 provenance
레버. 전역 trust 곱셈가중(weighted-RRF)은 A/B 에서 반증(θ=0.85 만으로 incident MRR
0.918→0.340 절벽, 점수 압축) — 필터가 see-saw 없는 올바른 레버.

- config [[workspace.sources]] (각 id/root/exclude/trust_level/source_type);
  단일 root 는 implicit `default` source 로 정규화. validate: id 유일·비어있지 않음.
- config schema v3→v4 (step_3_to_4, root→[[workspace.sources]] id=default 미러, 멱등)
- V014 documents.source_id 컬럼+인덱스 (additive, DEFAULT 'default', 재색인 0)
- Metadata.source_id + BodyHints trust precedence(frontmatter > source 기본값 > Primary)
- ingest: --root 미지정 시 resolved_sources() 순회 + doc 마다 source_id/trust stamp
- 검색 SearchFilters.source_type/source_id → lexical + vector 두 site (IN, OR)
- CLI kebab search --source <id> / --source-type <type> (repeatable/comma-sep)

도그푸딩(620 doc, jira400+wiki220): --source wiki 로 개념 질의 MRR 0.780→0.810,
--source jira 로 incident 0.918→0.975. trust precedence 실측(jira=secondary 기본값).

version bump 0.28.0 → 0.29.0 (신규 CLI flag + config 키 + V014 migration → minor).
follow-up: MCP search 필터 미노출 · kebab list source_id 미표시 · RAG provenance 라벨.

자세한 내용: tasks/HOTFIXES.md (2026-06-21), docs/release-notes/v0.29.0-draft.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Mc6W1fgsrbFKTsqA6P8La

crates/kebab-cli/src/main.rs

@@ -193,6 +193,31 @@ enum Cmd {
         )]
         code_lang: Vec<String>,
 
+        /// Phase-2: filter by document source_type
+        /// (`markdown`, `note`, `paper`, `reference`, `inbox`).
+        /// Repeatable or comma-separated. Empty = no filter.
+        /// The clean source/provenance lever for mixed-source KBs.
+        #[arg(
+            long = "source-type",
+            value_name = "TYPE",
+            num_args = 1,
+            value_delimiter = ','
+        )]
+        source_type: Vec<String>,
+
+        /// [[workspace.sources]]: filter by source id — the `id` of the
+        /// `[[workspace.sources]]` entry a document was ingested from
+        /// (e.g. `default`, `notes`, `code`). Repeatable or
+        /// comma-separated. Empty = no filter. The named-source
+        /// provenance lever for multi-source KBs.
+        #[arg(
+            long = "source",
+            value_name = "ID",
+            num_args = 1,
+            value_delimiter = ','
+        )]
+        source: Vec<String>,
+
         /// p9-fb-37: emit pre-fusion lexical / vector / RRF candidate
         /// lists + per-stage timing in the response. Bypasses cache
         /// (debug intent — fresh run guaranteed). Requires embeddings
@@ -615,12 +640,18 @@ fn run(cli: &Cli) -> anyhow::Result<()> {
             force_reingest,
         } => {
             let cfg = kebab_config::Config::load(cli.config.as_deref())?;
-            let scope = kebab_core::SourceScope {
-                root: root
-                    .clone()
-                    .unwrap_or_else(|| PathBuf::from(&cfg.workspace.root)),
-                exclude: cfg.workspace.exclude.clone(),
-                ..Default::default()
+            // [[workspace.sources]]: when the user passes `--root <dir>` we pin
+            // that single root (one ad-hoc `default` source). Otherwise we
+            // leave `scope.root` EMPTY so the app iterates every configured
+            // source (`config.resolved_sources()`); a bare empty scope.exclude
+            // is fine because each source carries its own merged exclude.
+            let scope = match root.clone() {
+                Some(r) => kebab_core::SourceScope {
+                    root: r,
+                    exclude: cfg.workspace.exclude.clone(),
+                    ..Default::default()
+                },
+                None => kebab_core::SourceScope::default(),
             };
 
             // p9-fb-02: spawn the progress display on a background
@@ -629,8 +660,7 @@ fn run(cli: &Cli) -> anyhow::Result<()> {
             // call returns, the `Sender` drops and the display thread
             // sees `recv()` return Err — exits cleanly.
             let plain_env = std::env::var("KEBAB_PROGRESS")
-                .map(|v| v.eq_ignore_ascii_case("plain"))
-                .unwrap_or(false);
+                .is_ok_and(|v| v.eq_ignore_ascii_case("plain"));
             let mode = progress::ProgressMode::from_flags(cli.json, cli.quiet, plain_env);
 
             // Surface the active embedding backend/device on the terminal so the
@@ -828,6 +858,8 @@ fn run(cli: &Cli) -> anyhow::Result<()> {
             doc_id,
             repo,
             code_lang,
+            source_type,
+            source,
             trace,
             bulk,
         } => {
@@ -967,6 +999,8 @@ fn run(cli: &Cli) -> anyhow::Result<()> {
                 doc_id: doc_id.as_ref().map(|s| kebab_core::DocumentId(s.clone())),
                 repo: repo.clone(),
                 code_lang: code_lang.clone(),
+                source_type: source_type.clone(),
+                source_id: source.clone(),
             };
 
             let q = kebab_core::SearchQuery {