feat(v0.7.40): add optional remote code evidence retrieval

[qiansc]

Summary

• Release version 0.7.40.
• Reuse available local evidence; otherwise use an authorized optional read-only context-sourcegraph service before local code retrieval.
• Keep recorded repository baselines, returned paths/lines, partial batch results and explicit local/offline behavior.
• Leave knowledge retrieval order and production source recovery unchanged.

Validation

• Frozen dependency installation, complete build, typecheck, lint and Node dist smoke checks passed. Lint reports existing warnings, no errors.
• Plugin projection and path auditing passed (15 tests); updated skill validation passed.
• Full unit/integration suite passed (208 seconds), full-only scenarios passed (39 tests), and the built CLI artifact passed. These runs collectively cover verify:full without repeating already-passed static checks.
• No deployment or registry publication has occurred. Owner will merge; GitHub Release/OIDC follows approval.