[codex] fix verification source ordering

[sarthakagrawal927]

What changed

• Wired citation verification to the same source ordering the model sees, including graph-route sources plus retrieval sources.
• Added a small helper to flatten verification sources in prompt order.
• Added a regression test that locks graph-first / retrieval-second ordering.

Why

• The prompt numbering was already combined across graph and retrieval sources, but verification still saw only the retrieval hits.
• That could make citation verification reason over a different source set than the model and final citations, which weakens the gate and traceability.

Validation

• uv run pytest -q tests/test_query_synthesis.py tests/test_duckdb_helpers.py
• uv run ruff check src/kb/query/engine.py tests/test_query_synthesis.py