🚑 fix(fb-31): apply final review nits

- kebab-app: add #[doc(hidden)] to ingest_stdin_with_config (CLAUDE.md
  convention — all *_with_config functions should have this attribute;
  fb-31's first impl missed it on the second facade fn).
- SKILL.md: "Since v0.4.0" → "Since v0.3.1" (MCP shipped in fb-30
  release v0.3.1; the wrong version claim was introduced in fb-30 doc
  sync and carried forward into fb-31).
- tools_call_ingest_file: add idempotency test (second call with same
  content → unchanged=1, new=0). Spec called for two tests; first impl
  shipped only the happy path.

Version bump 0.3.1 → 0.3.2 deferred to separate `chore/bump-v0.3.2` PR
mirroring fb-27 + fb-30 precedent (commits 73f5d73 / 5495d96).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/kebab-mcp/tests/tools_call_ingest_file.rs

@@ -51,3 +51,67 @@ async fn ingest_file_tool_returns_ingest_report_v1() {
     );
     assert_eq!(v.get("new").and_then(|n| n.as_u64()), Some(1));
 }
+
+#[tokio::test]
+async fn ingest_file_tool_idempotent_on_second_call() {
+    let dir = tempfile::tempdir().unwrap();
+    let workspace = dir.path().join("notes");
+    let data = dir.path().join("data");
+    std::fs::create_dir_all(&workspace).unwrap();
+    std::fs::create_dir_all(&data).unwrap();
+
+    let mut cfg = kebab_config::Config::defaults();
+    cfg.workspace.root = workspace.to_string_lossy().into_owned();
+    cfg.storage.data_dir = data.to_string_lossy().into_owned();
+    cfg.models.embedding.provider = "none".to_string();
+    cfg.models.embedding.dimensions = 0;
+
+    let src = dir.path().join("doc.md");
+    std::fs::write(&src, "# A\n\nbody.").unwrap();
+
+    let state = kebab_mcp::KebabAppState::new(cfg, None);
+    let handler = kebab_mcp::KebabHandler::new(state);
+
+    // First call.
+    let r1 = tokio::task::spawn_blocking({
+        let state = handler.state().clone();
+        let path = src.to_string_lossy().into_owned();
+        move || {
+            kebab_mcp::tools::ingest_file::handle(
+                &state,
+                kebab_mcp::tools::ingest_file::IngestFileInput { path },
+            )
+        }
+    })
+    .await
+    .unwrap();
+    assert!(!r1.is_error.unwrap_or(false));
+    let text1 = match &r1.content.first().unwrap().raw {
+        rmcp::model::RawContent::Text(t) => &t.text,
+        other => panic!("expected text, got {other:?}"),
+    };
+    let v1: serde_json::Value = serde_json::from_str(text1).unwrap();
+    assert_eq!(v1.get("new").and_then(|n| n.as_u64()), Some(1));
+
+    // Second call — same content, expect unchanged=1.
+    let r2 = tokio::task::spawn_blocking({
+        let state = handler.state().clone();
+        let path = src.to_string_lossy().into_owned();
+        move || {
+            kebab_mcp::tools::ingest_file::handle(
+                &state,
+                kebab_mcp::tools::ingest_file::IngestFileInput { path },
+            )
+        }
+    })
+    .await
+    .unwrap();
+    assert!(!r2.is_error.unwrap_or(false));
+    let text2 = match &r2.content.first().unwrap().raw {
+        rmcp::model::RawContent::Text(t) => &t.text,
+        other => panic!("expected text, got {other:?}"),
+    };
+    let v2: serde_json::Value = serde_json::from_str(text2).unwrap();
+    assert_eq!(v2.get("new").and_then(|n| n.as_u64()), Some(0), "{v2:?}");
+    assert_eq!(v2.get("unchanged").and_then(|n| n.as_u64()), Some(1), "{v2:?}");
+}