feat(rag): fb-41 PR-2 — RagPipeline::ask_multi_hop skeleton (fixed depth=2)

PR-2 of fb-41 multi-hop RAG. Decompose + retrieve + synthesize 3-stage
pipeline가 `opts.multi_hop=true` 일 때 dispatch. Dynamic decide loop
는 PR-3.

- `AskOpts.multi_hop: bool` 필드 추가 + `impl Default for AskOpts`
  도입 (HOTFIXES 2026-05-07 의 known limitation 해소). 9 explicit
  init site 모두 `multi_hop: false` 추가 — Default 도입으로 향후
  `..Default::default()` 점진 migrate 가능.
- `RagPipeline::ask` 의 entry 에 dispatcher 한 줄
  (`if opts.multi_hop { return self.ask_multi_hop(...) }`).
- `RagPipeline::ask_multi_hop` 신규 method. 1) decompose LLM call
  → JSON array of strings parse, 2) 각 sub-query 로 retrieve +
  chunk_id dedup pool, 3) score gate / no-chunks 가드, 4)
  pack_context (single-pass 와 helper 공유), 5) synthesize LLM
  call w/ MULTI_HOP_SYNTHESIZE_SYSTEM_PROMPT, 6) citation extract
  + Answer build. `prompt_template_version` = "rag-multi-hop-v1"
  로 stamp — eval `compare` 가 single-pass vs multi-hop 분리.
- Prompt const 신규: MULTI_HOP_DECOMPOSE_SYSTEM_PROMPT +
  MULTI_HOP_DECOMPOSE_USER_TEMPLATE + MULTI_HOP_SYNTHESIZE_SYSTEM_PROMPT
  + PROMPT_TEMPLATE_VERSION_MULTI_HOP + MULTI_HOP_MAX_SUB_QUERIES_DEFAULT.
- `kebab_core::RefusalReason::MultiHopDecomposeFailed` variant 신규.
  Cascade: kebab-store-sqlite `refusal_reason_label` + kebab-tui `ask
  refusal render` exhaustive match 갱신.
- `parse_decompose_response` + `strip_markdown_json_fence` helper —
  markdown code fence (```json / ```) strip + JSON array of strings
  parse + trim + drop empty + cap at MULTI_HOP_MAX_SUB_QUERIES_DEFAULT.
  None 반환 시 caller 가 `MultiHopDecomposeFailed` refusal.

Tests (55 passing total, 8 신규):
- 6 unit (parse_decompose_response 의 bare array / fence variants /
  garbage / cap / trim 회귀 핀).
- 2 integration: `ask_multi_hop_dispatches_and_decompose_garbage_refuses`
  (decompose garbage → MultiHopDecomposeFailed + 정확히 1 LLM call) +
  `ask_with_multi_hop_false_keeps_single_pass_path` (회귀 핀, 기존
  caller 자동 backwards-compat).

Happy-path multi-hop (decompose 성공 → synthesize) 의 integration
test 는 ScriptedLm helper 가 PR-3 의 decide loop 와 함께 도입될
때 같이 추가. 현 `MockLanguageModel` 는 canned single response 라
2-LLM-call sequence 핀 불가.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/kebab-rag/tests/pipeline.rs

@@ -75,6 +75,7 @@ fn default_opts() -> AskOpts {
         history: Vec::new(),
         conversation_id: None,
         turn_index: None,
+        multi_hop: false,
     }
 }
 
@@ -542,3 +543,95 @@ fn answer_json_serializes_with_expected_keys() {
     let trace_id = v["retrieval"]["trace_id"].as_str().unwrap();
     assert!(trace_id.starts_with("ret_"), "got trace_id {trace_id:?}");
 }
+
+// ── p9-fb-41: multi-hop dispatch + decompose-failure refusal ─────────────
+
+/// `AskOpts.multi_hop = true` routes into `ask_multi_hop`. When the
+/// (single) mock LLM returns garbage that `parse_decompose_response`
+/// can't deserialize as `Vec<String>`, the pipeline refuses with
+/// `RefusalReason::MultiHopDecomposeFailed`. Pins both the dispatch
+/// (different code path than single-pass) and the early-exit refusal.
+///
+/// Happy-path multi-hop (decompose succeeds → retrieve → synthesize)
+/// pins land in PR-3 once a scripted mock supports per-call response
+/// scripting (current `MockLanguageModel` returns the same canned
+/// string for every call).
+#[test]
+fn ask_multi_hop_dispatches_and_decompose_garbage_refuses() {
+    let env = RagEnv::new();
+    let cid = id32("c1");
+    let did = id32("d1");
+    env.seed_chunk(&cid, &did, "notes/a.md", "Body text.", &["Intro"]);
+    let hits = vec![mk_hit(1, &cid, &did, "notes/a.md", 0.85, &["Intro"])];
+    let retriever: Arc<dyn Retriever> = Arc::new(MockRetriever::new(hits));
+    // Garbage that is NOT a JSON array of strings — the only LLM call
+    // multi-hop makes here (decompose) returns this, so the pipeline
+    // never gets to synthesize and exits via the decompose-failure
+    // refusal path.
+    let lm = Arc::new(CountingLm::new("definitely not a JSON array"));
+    let lm_handle = lm.clone();
+    let pipeline = RagPipeline::new(
+        env.config.clone(),
+        retriever,
+        lm.clone() as Arc<dyn LanguageModel>,
+        env.sqlite.clone(),
+    );
+
+    let opts = AskOpts {
+        multi_hop: true,
+        ..default_opts()
+    };
+    let answer = pipeline.ask("compound question", opts).unwrap();
+
+    assert!(
+        !answer.grounded,
+        "decompose-failure refusal must report grounded=false"
+    );
+    assert_eq!(
+        answer.refusal_reason,
+        Some(RefusalReason::MultiHopDecomposeFailed),
+        "garbage decompose response must surface MultiHopDecomposeFailed"
+    );
+    assert!(
+        answer.citations.is_empty(),
+        "refusal Answer carries no citations"
+    );
+    assert_eq!(
+        answer.prompt_template_version.0, "rag-multi-hop-v1",
+        "multi-hop path must stamp the rag-multi-hop-v1 template version"
+    );
+    assert_eq!(
+        lm_handle.calls(),
+        1,
+        "decompose-failure exits before synthesize — exactly 1 LLM call"
+    );
+}
+
+/// Regression pin: `AskOpts.multi_hop = false` keeps the single-pass
+/// path. Same fixture as the snapshot test above; verifies that the
+/// PR-2 dispatcher doesn't accidentally divert legacy callers.
+#[test]
+fn ask_with_multi_hop_false_keeps_single_pass_path() {
+    let env = RagEnv::new();
+    let cid = id32("c1");
+    let did = id32("d1");
+    env.seed_chunk(&cid, &did, "notes/a.md", "Rust is a systems language.", &["Intro"]);
+    let hits = vec![mk_hit(1, &cid, &did, "notes/a.md", 0.85, &["Intro"])];
+    let retriever: Arc<dyn Retriever> = Arc::new(MockRetriever::new(hits));
+    let lm: Arc<dyn LanguageModel> = Arc::new(CountingLm::new("Rust is. [#1]"));
+    let pipeline = RagPipeline::new(env.config.clone(), retriever, lm, env.sqlite.clone());
+
+    let answer = pipeline.ask("what", default_opts()).unwrap();
+
+    assert_eq!(
+        answer.prompt_template_version.0,
+        // Single-pass stamps the config's prompt_template_version
+        // (config default = "rag-v2"), NOT "rag-multi-hop-v1".
+        env.config.rag.prompt_template_version,
+        "multi_hop=false must keep the config's prompt template (single-pass)"
+    );
+    assert_ne!(
+        answer.prompt_template_version.0, "rag-multi-hop-v1",
+        "multi_hop=false must NOT route through ask_multi_hop"
+    );
+}