fix: correct adapters against real running providers (round 2)

Ran real backends in isolated environments (real Postgres-backed gbrain,
live Sourcebot v6.5.0 with anonymous access, real graphify 0.9.23). All three
now index + search end-to-end. Fixes:

- gbrain: RESTORE `--strategy code` in refresh — round 1 removed it on a --help
  misread, which silently stopped code from ever being indexed. refresh now runs
  the verified two-pass (`sync`, then `sync --strategy code --full`). Pinned by a
  new test so the regression can't return.
- sourcebot: an API key is NOT required for local use — anonymous access
  (FORCE_ENABLE_ANONYMOUS_ACCESS=true) serves /api/search keyless (verified). Key
  stays optional; only the messaging changed (anonymous-access first, key as
  fallback) plus a note that a local repo needs remote.origin.url to index.
- graphify: correct the docstring — for CODE both `graphify <dir>` and
  `graphify update` are AST-only (no LLM); the LLM only renames clusters and
  ingests non-code, which our parser ignores. No LLM mode; local=true is correct.

Docs: capability matrix + "Verified against real environments" updated to record
all three proven end-to-end and to correct the two first-round mistakes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/code-intelligence.test.ts

@@ -281,6 +281,21 @@ exit 1
     expect(hits).toEqual([{ ref: "src/x.ts", score: 0.88, snippet: "match", kind: "document" }]);
   });
 
+  test("refresh runs the code-indexing pass (`sync --strategy code --full`)", async () => {
+    // Real gbrain only indexes code when `sync --strategy code` runs; without it
+    // code-def stays not_built. Pin that the adapter issues that pass.
+    const marker = path.join(homeDir, "sync-calls.log");
+    writeShim(`#!/usr/bin/env bash
+if [ "$1" = "sync" ]; then printf '%s\\n' "$*" >> "${marker}"; exit 0; fi
+if [ "$1" = "sources" ]; then echo '{"sources":[{"id":"code","local_path":"/r","page_count":1}]}'; exit 0; fi
+exit 1
+`);
+    await new GbrainProvider().refresh({ id: "code" }, { env: env(), consented: true });
+    const log = fs.readFileSync(marker, "utf-8");
+    expect(log).toContain("--strategy code");
+    expect(log).toContain("--full");
+  });
+
   test("engine-down (pglite WASM) degrades to PROVIDER_UNAVAILABLE, not PROVIDER_ERROR", async () => {
     // Reproduces garrytan/gbrain#223: engine fails to init; must degrade cleanly.
     writeShim(`#!/usr/bin/env bash