Add kb-update-events for batch event editing (tags, addressed-by)

[williamthorsen]

Add kb-update-events for batch event editing (tags, addressed-by)

Problem

Events have no edit path. The original need is marking multiple events addressed-by a shared reference (the five #784 events). The generic edit path injects assertion fields onto events and fails validation (#815).

Context

Part of the per-type record architecture epic (#848): Layer 2 introduces per-type commands, so events get their own edit path rather than reusing the assertion-biased generic engine. The KbEvent type and the type-blind note I/O layer (#849) are the foundation. The event command family adopts the kb- toolchain namespace; renaming the already-shipped capture-event to kb-capture-event is tracked separately (#863).

Proposed solution

Add kb-update-events, built on KbEvent and the type-blind note I/O layer — read → parse to KbEvent → mutate the typed record → render → atomic overwrite. It bypasses the generic frontmatter writer, so it does not reproduce #815.

• Batch by design: accepts one or more explicit event IDs plus a required --store (resolved by registry name or @default); each ID resolves to that store's event file. Each event is written atomically and independently; the result reports per-event success or failed-with-reason, and one bad ID never aborts the rest.
• Operation surface is the event mutable set only: --add-addressed-by (append references, de-duplicated) and --retag (replace with the canonicalized tag list). The operations are mutually exclusive — one per invocation, matching kb-edit.
• Promote tags and addressed-by to typed fields on KbEvent, so the command reads and writes them as the typed contract rather than from an untyped field map.
• No timestamp: events are write-once; addressed-by and tags are append-only/curatorial annotations, so marking does not stamp a timestamp (KbEvent has no updated).

Closes #815.

Acceptance criteria

Must have

• kb-update-events marks one or more events addressed-by a reference in a single invocation, de-duplicating entries.
• kb-update-events retags one or more events.
• tags and addressed-by are typed fields on KbEvent, not read from an untyped field map.
• Each event is written atomically; the result reports per-event success or failure.
• An edited event round-trips and passes validation (the Frontmatter writer injects empty title/created onto records that lack them (events) #815 scenario).
• New behavior is covered by tests, including a multi-event invocation mixing success and failure.
• Command help and KB command docs cover kb-update-events.