docs: fix cache-service frontmatter, knowledge dead links, TCK glossary term (#1880 follow-up)

Three doc-accuracy fixes the #1880 audit surfaced but whose hard rules
(preserve-frontmatter / no-fabrication) blocked in PR #3243:

- kernel/contracts/cache-service.mdx frontmatter: drop "namespaces, and bulk
  operations" — the ICacheService contract only exposes
  get/set/delete/has/clear/stats (packages/spec/src/contracts/cache-service.ts).
- protocol/knowledge.mdx: repoint 3 references from the removed
  `ai-capabilities.mdx` (dead since the docs reorg) to the real
  `actions-as-tools.mdx`, dropping the stale anchor.
- getting-started/glossary.mdx: qualify the "TCK (Technology Compatibility
  Kit)" entry as planned / not-yet-implemented (grep-empty across packages).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012urEihGTAsQP2xizAqfCwt

Author: claude

content/docs/getting-started/glossary.mdx

@@ -157,4 +157,4 @@ The default sharing level (Security Protocol) for records in an object. Determin
 A hierarchical access control model (Security Protocol) that grants data access based on geographic or organizational boundaries.
 
 ### TCK (Technology Compatibility Kit)
-A suite of tests that validates if a Driver or Renderer complies with the official ObjectStack Protocol. If a new driver passes the TCK, it is certified as compatible.
+A **planned** suite of tests that would validate whether a Driver or Renderer complies with the official ObjectStack Protocol, certifying a passing driver as compatible. _Not yet implemented — there is no TCK program or certification mechanism in the codebase today._

content/docs/kernel/contracts/cache-service.mdx

@@ -1,6 +1,6 @@
 ---
 title: ICacheService Contract
-description: Reference for the Cache Service contract — key-value caching with TTL support, namespaces, and bulk operations
+description: Reference for the Cache Service contract — key-value caching with TTL support
 ---
 
 # ICacheService Contract

content/docs/protocol/knowledge.mdx

@@ -169,7 +169,7 @@ interface IKnowledgeService {
 
 `KnowledgeSearchOptions` includes `sourceIds`, `topK`, `filter`, and
 the all-important `executionContext` (from the permission-aware tool
-execution work — see `ai-capabilities.mdx`). `KnowledgeReindexOptions`
+execution work — see `actions-as-tools.mdx`). `KnowledgeReindexOptions`
 accepts `dryRun` and `limit`; `reindexSource` returns a
 `KnowledgeReindexResult` (`indexed`, `discovered`, `ok`, …).
 
@@ -255,7 +255,7 @@ IKnowledgeService.search(q, { executionContext, sourceIds })
 ```
 
 This is the same pattern as the existing permission-aware data tools
-(see `ai-capabilities.mdx#permission-aware-execution-rls-for-agents`).
+(see `actions-as-tools.mdx`).
 No matter how aggressive an adapter's retrieval is, the user never
 sees a chunk extracted from a record they can't read.
 
@@ -347,7 +347,7 @@ internally (RAGFlow, Dify, Vectara).
 
 ## 10. Related documents
 
-- `ai-capabilities.mdx#permission-aware-execution-rls-for-agents` —
+- `actions-as-tools.mdx` —
   the `ExecutionContext` threading the Knowledge Protocol reuses.
 - `architecture.mdx` — overall service / plugin layering.
 - `packages/spec/src/ai/embedding.zod.ts` — pre-existing embedding /