feat(records): every typed kind gets all five doors and a duplicate report (#4164)

Arising from #3731, which shipped a lesson with three of five tools and logged
the rest rather than widening its own scope. The operator's framing on reading
that: each kind deserves CRUD functions and to show up in the search and report
functions. So this fixes the property, not the two instances.

WHAT WAS MISSING FOR A LESSON: no delete, no list, and no duplicate report.
`delete_lesson` is the #2250 situation exactly — the trash is kind-agnostic so
`delete_note` always reached a lesson, but nothing said so, and a kind whose own
tools offer create/read/update reads as one you cannot retire. `list_lessons` is
the only way to ask what has been learned at all: `get_lesson` needs an id you
already have, and semantic search returns what resembles a query, never the set.

APPLYING THE RULE FOUND THE SAME REPORT GAP FOR PROCESSES, which have had full
CRUD for months and have never been in `_REPORT_KINDS` either. Both are in now,
each compared only against its own kind.

The lesson report default is 0.90 — the general semantic floor, deliberately
BELOW its own write-path bar of 0.96. The gate is permissive on purpose so it
does not refuse two genuinely different lessons whose triggers read alike, and
that tolerance is precisely what wants reviewing later, so the report looks at
the band the gate was told to let through. Safe there and not at the gate,
because a report proposes and the operator picks where the gate blocks a write.

A BUG CAUGHT BEFORE IT SHIPPED: `list_lessons` first read the trigger from
`it["data"]`, which `_note_to_item` does not carry — it projects named keys off
the mirror (`language`, `verification`) rather than the column. Every row would
have listed an empty trigger, which on a kind whose whole point is the trigger
is the failure looking like the feature. `when_to_apply` is now projected there
beside the others, so every listing surface gets it, including step 7's UI.

The guard asserts the PROPERTY rather than the instances: for each typed kind,
all five tools exist, are actually offered by register(), are classified for
auth, and the kind has a duplicate report. Derived from the kinds themselves, so
a fourth inherits the bar. A per-tool test cannot catch a missing tool, which is
why four steps of milestone 385 went green over this.

`find_duplicate_records` now validates against `_REPORT_KINDS` instead of its
own literal — the second copy is what would have refused a kind the service
already supported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

src/scribe/mcp/tools/notes.py

@@ -310,8 +310,14 @@ async def find_duplicate_records(kind: str = "note", threshold: float = 0.0) ->
     project's records, or when you suspect the same ground was covered twice.
 
     Args:
-        kind: "note" (documents) or "task". Snippets have their own report,
+        kind: "note" (documents), "task", or "lesson". Each kind is compared
+            only against its own — a to-do and a write-up are not alternatives
+            to each other. Snippets have their own report,
             find_duplicate_snippets, whose groups propose a lossless merge.
+            LESSONS are the kind most worth running this on: their create gate
+            is deliberately permissive (it sits above the band where two
+            genuinely different lessons about one area would block each other),
+            so this report is where that tolerance gets reviewed.
         threshold: Similarity floor, 0-1. 0 uses the configured setting.
 
     READ THE `suggestion` FIELD BEFORE ACTING, because the right fix differs by
@@ -324,9 +330,15 @@ async def find_duplicate_records(kind: str = "note", threshold: float = 0.0) ->
     question.
     """
     uid = current_user_id()
-    if kind not in ("note", "task"):
-        raise ValueError('kind must be "note" or "task" — snippets have their '
-                         "own report, find_duplicate_snippets")
+    # Validated against the service's own list rather than a second copy here,
+    # so a kind added there reaches this door instead of being refused by a
+    # literal nobody remembered to widen.
+    allowed = tuple(k for k in dedup_svc._REPORT_KINDS if k != "snippet")
+    if kind not in allowed:
+        raise ValueError(
+            f"kind must be one of {', '.join(allowed)} — snippets have their "
+            "own report, find_duplicate_snippets"
+        )
     return await dedup_svc.find_duplicate_records(
         uid, kind=kind, threshold=threshold if threshold > 0 else None,
     )