feat: KBDB self-hosted 查詢 + embed 模組 + thin-shell 收窄 + search_workflow（code done 待端到端）

按 issue 分段標明（檔 #5/#8 改動交疊處無法乾淨拆檔，故併一個 commit）：

#4 thin-shell §3.1 自力救濟階梯 + code-node 規則（純文檔/規則，code-node 零件未實作）
#5 KBDB source filter（json_extract metadata_json 零建表）+ 能力對照；documents 聚合與
   DELETE proxy 部分擱置等頂層 T8
#7 base embed 模組（kbdb/src/embed.ts）+ vectorize 開關（deploy/config/wrangler.toml 註解範本）
   + 語義查詢降級閉環（mode=semantic 未開→LIKE+capability_hint）
#8 部分（workflow-discovery）：
   - KBDB /entries/search 加 base 通用 entry_type filter（entry-crud/embed/route/kbdb-proxy 透傳）
   - /webhooks/named 強制 description（空→400，訊息要求操盤 AI 據實寫一句）
   - 部署雙寫 entry_type=workflow embeddable entry（waitUntil 非阻塞，供 search）
   - cypher GET /workflows/search + MCP u6u_search_workflows（優先語意、降級 hint）
   - cypher POST /workflows/backfill-search-entries（無 desc 列出不編造）
   - GET /webhooks/named 補回 description/created_at 欄位（為 list 來源收斂備）

⚠️ tsc 綠 = code done，非完成（mindset §7 禁假綠）：
- #7/#8 端到端待 leo21c 部署驗（Vectorize 需官方憑證、CC 跑不了）
- #8 ①-a（MCP deploy 改打 /webhooks/named）未做、MCP deploy 那半仍 404
- #8 端到端（強制填擋空/語義命中/租戶隔離/降級 hint）未驗

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kbdb/src/actions/record-crud.ts

@@ -88,6 +88,52 @@ export async function createRecord(db: D1Database, input: CreateRecordInput): Pr
   return { record_id: recordId, template_id: tpl.id, values: input.values };
 }
 
+// Update an existing record's slot values (mira-dissolve T2.1, issue #6).
+// "Deprecate by flipping a slot value" — base append-only is NOT broken: we change the
+// underlying entries.content of the slot's entry, we do not alter table structure / add columns / delete rows.
+//   - slot already on the record → UPDATE the linked entries.content.
+//   - slot valid for the record's template but not yet present → create entry + entry_value (idempotent grow).
+//   - slot not in the template's slots_json → reject (records must stay template-shaped).
+// Returns null if the record does not exist.
+export async function updateRecord(
+  db: D1Database,
+  recordId: string,
+  values: Record<string, string>,
+): Promise<RecordResult | null> {
+  // Existing slot → entry_id + template_id for this record.
+  const evRes = await db
+    .prepare(`SELECT slot_name, entry_id, template_id FROM entry_values WHERE record_id = ?`)
+    .bind(recordId)
+    .all<{ slot_name: string; entry_id: string; template_id: string }>();
+  const evRows = evRes.results ?? [];
+  if (evRows.length === 0) return null; // record does not exist
+
+  const templateId = evRows[0].template_id;
+  const slotToEntry = new Map(evRows.map((r) => [r.slot_name, r.entry_id]));
+
+  const tpl = await getTemplate(db, templateId);
+  const allowed: string[] = tpl ? JSON.parse(tpl.slots_json) : [...slotToEntry.keys()];
+
+  for (const [slot, content] of Object.entries(values)) {
+    if (!allowed.includes(slot)) {
+      throw new Error(`slot not in template: ${slot}`);
+    }
+    const entryId = slotToEntry.get(slot);
+    if (entryId) {
+      // flip the slot value: update the linked entry's content (table structure untouched)
+      await db.prepare(`UPDATE entries SET content = ?, updated_at = unixepoch() WHERE id = ?`).bind(content, entryId).run();
+    } else {
+      // valid template slot not yet on this record → grow it (create entry + link)
+      const entry = await createEntry(db, { content, entry_type: 'value' });
+      await db
+        .prepare(`INSERT INTO entry_values (id, record_id, template_id, slot_name, entry_id) VALUES (?, ?, ?, ?, ?)`)
+        .bind(uid('ev'), recordId, templateId, slot, entry.id)
+        .run();
+    }
+  }
+  return getRecord(db, recordId);
+}
+
 export async function getRecord(db: D1Database, recordId: string): Promise<RecordResult | null> {
   const res = await db
     .prepare(