Add incremental Messages archive and search

[jmcte]

Summary

• add an internal, read-only Messages archive adapter backed by consistent SQLite/WAL snapshots
• persist bounded cursors, source fingerprints, deduplicated message ids, group-chat identity, and safe deletion tombstones
• add versioned local archive search with metadata/body separation
• require explicit body retention and separate confirmation for body search; keep send/react/actions out of scope

Governing Issue

Closes #95

Validation

• Relevant local checks passed

• Required PR checks are expected to satisfy CI Gate

• Skipped checks are explained below

• swift test --disable-sandbox — 134 tests passed

• bash scripts/ci/run-fast-checks.sh — passed; 88.83% source line coverage, mutation checks, debug and release builds passed

• synthetic DB tests cover cursor resume, deduplication, group chats, deletion tombstones, redaction, body retention, and untrusted batch rejection

No checks skipped.

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

No contributor guidance changed. This PR is stacked on #101–#104 and remains draft until those foundations merge.

Flow Contract

• Owner lane: Hermes native data provider
• Repair owner: jmcte
• Autonomy class: review-gated implementation
• Risk class: security-sensitive local Messages metadata

Flow Merge Readiness

• Every blocker has a next actor and next action
• No active blocking requested changes remain
• Non-author approval is present when required
• PR author enabled auto-merge where GitHub allows it, or recorded why it is unavailable/unsafe

Next actor: foundation reviewers, then independent security and architecture review.

Merge Automation

• PR author enabled auto-merge with gh pr merge --auto --squash, or the reason it is unavailable/unsafe is noted below

Auto-merge is deferred only while this PR is stacked on #101–#104.

Notes

• External archive JSON cannot self-authorize sensitive body fields; only the internally gated Messages adapter can opt them in.
• Attachments, attributed-body blobs, send, react, SIP changes, private-framework injection, and remote export are explicitly excluded.

[Hermes-omt]

Review deferred: the live head 2d6816c is merge-conflicted with main (mergeable=false, mergeable_state=dirty). Rebase/update this branch onto main, resolve conflicts, and wait for fresh CI before substantive review. Node-local exact-head inspection and Messages archive tests completed successfully, but this stale/conflicted head cannot be approved.