Retrieve Y2 Global Knowledge

Runs bounded hybrid retrieval over shared Y2 knowledge and, when requested, the API key's bound workspace corpus. Access identifiers and provider filters are derived by Y2; the request cannot supply a user or workspace ID. Results are discovery evidence, include source IDs and citations, and omit provider and access-control attributes. This operation requires a workspace-bound API key with `intel:knowledge`. It does not support x402. Agent Y2 keys continue to use `agent:y2`; the agent may invoke this retrieval tool internally when the workspace is entitled to Chat.