kb-query goes live — the Cloudflare Worker replaces the local clone
What changed
Switches the kb-query MCP server from a stdio process reading a gitignored local kb/ clone to the live Streamable HTTP endpoint the KB repo now deploys — same six tools, same names, so no caller changes, but the corpus is now whatever main last deployed instead of whatever one machine last synced. Also fixes check-harness-grants' isMain guard (a file:// string-concat check that silently no-op'd on Windows), points verify-drift at _claude-skill.yml too, and grants kb-query to cloud ticks.
Why it changed
Sessions were querying stale local snapshots — one was verified 20+ commits behind the live corpus (2f42303 local vs 3753bd1 live) — instead of a consistent, always-current source of truth.