feat(import): Open Knowledge Format (OKF) import

[ethanj]

Stacked on the OKF export branch (#100). Base will retarget to main once that merges; the diff here is the import delta only.

What

Adds llmwiki import --okf <dir> [--trusted], the inverse of the OKF export — it reads a conformant Open Knowledge Format (OKF) v0.1 bundle and maps each document back into a llmwiki page, reusing the shared, reversible OKF↔llmwiki mapping.

• Default: staged for review. Imported docs become review candidates (reviewMode: imported, held reason imported-okf) and flow through the existing review list/show/approve lifecycle. External knowledge never reaches the live wiki without a human in the loop.
• --trusted: write live. Runs the identical pipeline (read → map → validate → collision-check) and only skips the human-staging step, writing pages straight into wiki/. It does not skip validation or collision safety, and the live write + index/MOC refresh run under the same .llmwiki lock that compile and approve use.
• Durable, attributable origin. Imported pages carry provenanceState: imported plus an okf:<bundle> source token that survives approval, so downstream retrieval and evals can always tell foreign knowledge from locally-compiled, citation-validated pages. Their locally-computed freshness is unverified.
• Lossless, identity round-trip. A native export→import preserves the canonical body byte-for-byte, the page kind, sources, citations (via inline ^[…] claim markers), and routes query pages back to wiki/queries/. The page slug is identity (concepts/rag.md → rag).
• Tolerant of foreign bundles. An unknown type maps to kind: concept with the raw type preserved under x-okf.type; the full original frontmatter is snapshotted under x-okf.originalFrontmatter; unknown keys and broken links are kept, never rejected.

Why

OKF is an emerging standard for portable agent knowledge. Pairing import with the export target makes compiled wikis a true round-trip surface — bundles can leave as OKF and come back without losing the compiler's richer provenance — while keeping foreign, untrusted bundles gated behind review.

Safety (untrusted-input ingestion)

Import treats every bundle as untrusted: a single confined, resource-bounded reader rejects (never truncates) bundles exceeding file-count / per-doc / total-size caps; every file is realpath-confined to the bundle root (symlink escapes are skipped); frontmatter parses on js-yaml's default safe schema; and both write paths run page validation and the skip-and-warn collision policy (never overwriting a live page, a pending candidate, or an intra-bundle duplicate).

Test plan

• npx tsc --noEmit, npm run build, npm test (1599 passed), npx fallow (0 above threshold), CI-strict dupes clean
• Native round-trip: canonicalBody(imported) === canonicalBody(original), kind/sources/citations preserved, query page routed to wiki/queries/
• Durable imported provenance + okf: token survive approval; no state.json ownership written
• Path confinement (symlink escape), resource-cap rejection, collision skip (incl. under --trusted), nested-slug non-collapse, freshness unverified, and a subprocess CLI test