fix(knock): refuse a knock whose target resolved nowhere (#145)

`spt knock <target>` folded the wire leg's NotFound outcome into the LOCAL
landing with no local-existence check: a target on no reachable node was
recorded in the SENDER's own store and reported "It is waiting in their
inbox", exit 0. The fall-through sat ten lines under a comment naming the
exact hazard it then committed — "a local-only record would leave the
operator believing they asked when nobody was told".

Field case (releases#145): ball-b@ENLYZEAM knocked lia@HFENDULEAM and got a
positive stdout while lia's node held zero knock rows. Both nodes are members
of one CLOSED subnet, where endpoint-tier discovery is deny-default BY
DESIGN, so resolution NotFounded correctly — the whole defect is the CLI's
answer to it.

Operator-ruled 2026-08-03: if `spt knock` cannot reach endpoints on nodes
lacking a DISCOVER rule, it must directly report that it cannot find the
endpoint.

- `knock_landing` decides the landing as a PURE function of the outcome and
  whether the target is an endpoint HERE. The local landing survives only for
  a verified-local target — it exists for a LOCAL endpoint carrying no
  registry row (unregistered or asleep), which is exactly what the locality
  question separates from a target that exists nowhere.
- `knock_target_is_local_endpoint` asks of the target the same perch +
  info.json question `--for` already asks of the knocker.
- `knock_closing_line` composes every landing's line at one site, so the
  second half of the defect — the local and remote landings printing an
  IDENTICAL positive sentence — is renderable in a test. Reading the literals
  could not have caught it: they were the same literal.
- The refusal names the remedy that actually reaches an undiscoverable
  endpoint (mint a knock-code there, redeem it here) in forms the binary
  honors, per REQ-KNOCK-PRESCRIBED-REMEDY-HONORED applied to a refusal's
  advice. It returns before any `store.save()`, so "nothing was recorded" is
  a fact about the store rather than a claim about intent.

REQ-KNOCK-UNRESOLVED-REFUSES minted with impl/unit/int active. Units cover
the decision (both arms driven by locality alone, against ONE outcome value),
the partition of `KnockSendOutcome` between the two renderers, and the three
landing lines rendered and asserted distinct. The int row runs the real
binary: a ghost target exits nonzero, names KNOCK_NOTFOUND and leaves no
store file, beside a local endpoint on the same home landing and exiting 0 —
so the refusal is discriminating rather than a verb that always refuses.

fixes #145

Co-authored by: todlando