feat(memory): add version-aware development history core - #456

Summary

• Add repository-local, event-sourced Memory storage with immutable revisions, append-only events, CAS-protected refs, and rebuildable SQLite projections.
• Compile terminal Task and Intent development history into version-bound Episodes with structured evidence.
• Add deterministic FTS5/BM25 retrieval, Git applicability checks, and audited context injection through context-selection receipts.
• Expose Memory search/show/status/rebuild commands and Agent Bridge 1.2 integration: audited memory.recall plus opt-in memory.episode.record for completed DSH turns.

Architecture

The implementation follows the design accepted in #454:

1. Content-addressed objects and the protected Memory ref preserve authoritative history.
2. SQLite stores rebuildable projections, bounded compiler jobs, FTS5 indexes, and context-selection receipts.
3. Task Episodes summarize one development task; Intent Episodes pin contributing Task revisions.
4. Retrieval freezes repository, code, and projection state before ranking and context injection.
5. DSH capture records canonical Task/Run/Decision/TaskEvent evidence and invokes the existing Episode compiler, admission policy, and writer. The caller cannot choose repository authority or actor identity.

Upstream integration

Merged current upstream main through a4d6ca6b11489e734571cca071dd3dd9aadc5c59 in merge commit 191094fd61d3cbc46a9ffa5785c4d16b7d2a6cee, preserving the existing PR branch history.

• Honor upstream's removal of the former Code UI, Publish/Worker, Web, MCP, and obsolete operation-wrapper surfaces instead of reviving them during conflict resolution.
• Preserve current Operation v2 schema, migration, GC, and command behavior.
• Keep Memory authority local-only across clone, fetch, push, local discovery, branch/update-ref, and symbolic-ref boundaries.
• Protect the owner-managed memory.keyed_digest.v1 configuration surface.
• Move the unpublished Memory migrations after the current upstream schema tip:
  • 2026092501_memory_core
  • 2026092502_memory_fts_search
  • 2026092503_context_selection_receipt

The migration runner only applies versions above the current tip. The new ordering prevents repositories already on upstream 2026091901 from skipping Memory tables. Memory SQL semantics are unchanged.

DSH integration

Enable completed-turn capture with LIBRA_DSH_MEMORY_MODEL=deepseek-chat on the bridge and captureMemoryEpisodes: true in the separately maintained DSH plugin. A compiler credential is required. Recall alone remains available without a compiler model.

Capture uses the first-turn code HEAD and completion HEAD, targets that turn's compilation job, and retains SHA-1 code-anchor compatibility. The plugin's real DSH v0.1.2-alpha.1 gate previously generated a structured Episode with a real compiler model, verified its stored projection/receipt, remounted the plugin, and recalled the result through a real headless model run.

The shelved native Libra DSH runtime is not included. The plugin's Cordis refactor is separate preparation work, not part of this PR.

Verification

Checks run in the libra-dev-anduin development container on leris after resolving the merge:

• cargo +nightly fmt --all --check: passed.
• cargo check --all-targets --all-features: passed.
• cargo clippy --all-targets --all-features -- -D warnings: passed.
• cargo test --test memory_episode_test --test fts5_capability_test -- --test-threads=1: 4 passed.
• cargo test --test command_test memory -- --test-threads=1: 4 passed.
• cargo test --lib memory -- --test-threads=1: 146 passed.
• Built-in migration registry regression: passed with 68 migrations and latest version 2026092503.

The first full cargo test --all -- --test-threads=1 run completed 3,510 library tests: 3,504 passed and 6 failed. Two merge-related failures (Memory operation scope and migration registry expectations) were fixed and passed exact reruns. The remaining four failures were reproduced unchanged on a detached pure upstream/main worktree in the same container: the existing-pack-index assertion, descendant-process cleanup, and two bubblewrap usability checks. The container has a root-owned /usr/bin/bwrap, but Docker does not permit namespace creation. GitHub CI is the authoritative clean-environment result.

Review guide

1. Migrations, contracts, writer, and projection replay.
2. Bounded evidence sources, per-root generation jobs, and Episode compilers.
3. FTS5/BM25 reader, frozen views, and audited context injection.
4. Bridge session binding, completed-turn capture, code anchors, and Memory CLI.

Memory remains repository-local. Remote Memory publication, the separate DSH plugin refactor, and the shelved native DSH runtime are out of scope.

Refs #451
Builds on #454