feat: richer scopes on Claim/Source — `(visibility, project, agent)` [VEP]

[plind-junior]

What you're trying to do

Claim and Source carry a single scope enum today
(src/vouch/models.py:141,195). With multi-agent sync landing (#90/#91), a KB
shared across agents/projects needs to carve up who-sees-what.

ROADMAP 0.2 marks this [VEP].

Acceptance

• Claims/sources can be scoped along (visibility, project, agent).
• Out-of-scope artifacts are excluded from retrieval.
• Backward compatible default for existing KBs.