fix(api): default hall=facts source_type to internal (brain-gardener#7)

The unsourced-check fix (source_type: internal) only covered
claudewatcher's writes. 41 residual findings on the audit's next run
were manually-authored hall=facts entries written via brain_write/
capture -- also first-party observations, just a different write path,
with no way to mark them internal short of hand-editing every entry.

writeHallNote now defaults source_type to internal whenever hall ==
"facts" and the caller didn't set it explicitly. An explicit
source_type: external (now threaded through the /write HTTP endpoint)
opts a genuinely citation-needing entry back out.

ingestion/internal/api/handler_test.go

@@ -137,7 +137,7 @@ func TestWriteNote_HallRouteIncludesSourceTypeWhenSet(t *testing.T) {
 	assert.Contains(t, string(got), "wing: claude-sessions")
 }
 
-func TestWriteNote_HallRouteOmitsSourceTypeWhenUnset(t *testing.T) {
+func TestWriteNote_HallFactsDefaultsSourceTypeInternalWhenUnset(t *testing.T) {
 	dir := t.TempDir()
 
 	rel, err := api.WriteNote(dir, api.WriteNoteOptions{
@@ -147,6 +147,40 @@ func TestWriteNote_HallRouteOmitsSourceTypeWhenUnset(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
+	require.NoError(t, err)
+	// Most hall=facts entries are first-party (an eval/benchmark the agent ran
+	// itself), not external claims — default to internal, require explicit
+	// opt-out for the rare case that does need a citation (brain-gardener#7).
+	assert.Contains(t, string(got), "source_type: internal")
+}
+
+func TestWriteNote_HallFactsPreservesExplicitExternalSourceType(t *testing.T) {
+	dir := t.TempDir()
+
+	rel, err := api.WriteNote(dir, api.WriteNoteOptions{
+		Content:    "vendor pricing claim, needs a citation.\n",
+		Wing:       "agentsquad",
+		Hall:       "facts",
+		SourceType: "external",
+	})
+	require.NoError(t, err)
+
+	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
+	require.NoError(t, err)
+	assert.Contains(t, string(got), "source_type: external")
+}
+
+func TestWriteNote_HallRouteOmitsSourceTypeForNonFactsHalls(t *testing.T) {
+	dir := t.TempDir()
+
+	rel, err := api.WriteNote(dir, api.WriteNoteOptions{
+		Content: "a decision record.\n",
+		Wing:    "agentsquad",
+		Hall:    "decisions",
+	})
+	require.NoError(t, err)
+
 	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.NotContains(t, string(got), "source_type")