E2E-2: knowledge_cache_attest uses shared read-audit API

[Cho-Geer]

E2E-2: knowledge_cache_attest uses shared read-audit API

Parent Epic: #87

Verify that knowledge_cache_attest.ts uses getReadEventsForSession() and normalizeReadAuditPath() from read-audit.ts instead of inline readAuditLog().

Commands

grep -c "getReadEventsForSession\|normalizeReadAuditPath" .opencode/tools/knowledge_cache_attest.ts
# Should return >= 2
grep -c "readAuditLog\|read_audit.jsonl" .opencode/tools/knowledge_cache_attest.ts
# Should return 0