fix: harden gossip, HLC restarts, watcher races, MCP args, pagination

- gossip: validate push batches (4 MiB / 1000-row caps); reject rows
  claiming the local node id (vector-poisoning), empty ids, negative HCLs
- gossip: reconcile derived state after pulls (pulls only append to the
  observation log, so entry-count comparison could never trigger it)
- hlc: seek clock from persisted MAX(hcl) at Open so a restart with a
  regressed wall clock cannot reissue values (locator/cursor safety)
- db: serialize writers via BEGIN IMMEDIATE DSN, single conn per pool,
  and a per-KnoxDB mutex around RecordObservation's dedup
- watch: atomic ticker guards (was a cross-goroutine data race),
  trailing-edge per-path debounce, recursive directory watches,
  rename re-ingest, remove cancels pending ingests
- mcp: strict argument validation (no silent clamping), thread existence
  checks before writes, nil-safe golden-thread tool
- cli: --page 0 no longer panics; query/recent pagination actually pages
- tests: hlc SeekTo monotonicity, concurrent dedup race, push validation,
  batch caps, idempotency on observation counts

internal/hlc/hlc.go

@@ -27,6 +27,23 @@ type Clock struct {
 
 func New() *Clock { return &Clock{} }
 
+// SeekTo adopts the given packed HLC value when it is ahead of the clock's current
+// position, so the next Now is still strictly increasing. Used to resume a node's
+// clock from its persisted MAX(hcl) at startup — without it, a restart with a
+// regressed wall clock would reissue already-used values and break the
+// monotonicity the (node_id, hcl) locator uniqueness and gossip cursors rely on.
+func (c *Clock) SeekTo(v int64) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	wall := v >> wallShift
+	seq := v & seqMask
+	if wall > c.wallMS || (wall == c.wallMS && seq > c.seq) {
+		c.wallMS = wall
+		c.seq = seq
+	}
+}
+
 // Now returns the next monotonic HLC value and the wall-clock time embedded in
 // it. The returned time is the HLC's wall component — never ahead of the local
 // clock beyond the current call and never rewinding across calls.