Guard Knowledge Workspace memory candidates as review proposals

[yvette-carlisle]

Summary

• Add explicit authority-boundary metadata to Knowledge Workspace changed-source memory candidates.
• Document that knowledge delta candidates are reviewable consolidation proposals, not Memory Authority mutations.
• Extend unit assertions for the non-authoritative review surface.

Manual intervention

• Reason: Decodex attempts for XY-1153 failed before producing an effective diff. Attempt 2 and 3 recorded no_effective_diff; the Decodex run also hit an app-server output timeout. The retained worktree was clean except Decodex metadata, so I manually implemented the smallest aligned slice in the Decodex worktree.
• Files touched: packages/elf-service/src/knowledge/watch/candidates/proposal.rs, packages/elf-service/src/knowledge/tests_memory.rs, packages/elf-service/src/knowledge/tests_helpers.rs, docs/spec/system_knowledge_pages_v1.md, docs/log.md.
• Commands run: cargo make fmt-check; targeted cargo test -p elf-service knowledge::tests::tests_memory::memory_candidate_uses_reviewable_consolidation_proposal_contract; python3 scripts/check-docs.py; git diff --check; full cargo make checks.
• Benchmark/review impact: no benchmark suite added in this slice; full repo checks pass and the new unit coverage strengthens the XY-1153 authority-boundary gate.
• Remaining Decodex handoff state: PR is human/manual-created after Decodex retained-attention failure; Decodex closeout/rebind may still be needed after review/merge.

Validation

• cargo make checks