feat(memory): durable note store and memory tool

Split 2/3 of #829, stacked on the pathjail primitive from #891 (1/3).

- internal/memory: a durable note store confined to a pathjail handle, so every
  read, write, rename and delete stays on the confined handle rather than being
  re-resolved by pathname. Writes publish through an O_EXCL temporary file, and
  the final component is checked for a reparse point before each write.
- internal/tools/memory.go: the memory tool over that store.

Note names are an ALLOW-LIST matching the plan store's rule
(^[a-z][a-z0-9-]{0,63}$), and lowercase-only is load bearing: Windows and a
default APFS volume fold case, so "Findings" and "findings" would be one file
there — the second write silently replacing the first's body and a delete of one
removing the other. Reserved DOS device names are refused on top of the pattern,
because os.Root addresses notes relative to a handle and so creates "con.md"
happily, while `git add -A` then fails on that path and stages nothing, and a
repo carrying one cannot be checked out on Windows at all.

Frontmatter parses CRLF as well as LF: project notes are checked in, and Git for
Windows defaults to autocrlf=true, so a note that merely round-trips through a
clone came back with its header rendered as body and no description.

Registration into the tool registry lands with the orchestration wiring in 3/3,
where the shared registry changes live.

Author: gnanam1990

internal/memory/escape_test.go

@@ -0,0 +1,101 @@
+package memory
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// linkDir uses a junction on Windows: it needs no privilege, unlike a symlink,
+// so it is both the reachable attack and the only one testable on an ordinary
+// Windows account.
+func linkDir(t *testing.T, target, link string) {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		if out, err := exec.Command("cmd", "/c", "mklink", "/J", link, target).CombinedOutput(); err != nil {
+			t.Skipf("cannot create a junction: %v %s", err, out)
+		}
+		return
+	}
+	if err := os.Symlink(target, link); err != nil {
+		t.Skipf("cannot create a symlink: %v", err)
+	}
+}
+
+// The store used to check only its own directory and file, so a link at the
+// ANCESTOR .zero turned every operation into one aimed outside the workspace:
+// Write and Forget were arbitrary write and delete, and Read was an arbitrary
+// read in a tool the model can call by name.
+//
+// All three are asserted, because fixing one and leaving the others is exactly
+// what the original guard did.
+func TestAnAncestorLinkCannotTakeTheStoreOutOfTheWorkspace(t *testing.T) {
+	base := t.TempDir()
+	outside := filepath.Join(base, "outside")
+	workspace := filepath.Join(base, "workspace")
+	for _, dir := range []string{outside, workspace} {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// A note already sitting in the external directory, so a successful read
+	// would be visible rather than merely "no error".
+	if err := os.MkdirAll(filepath.Join(outside, "memory"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	secret := filepath.Join(outside, "memory", "secret.md")
+	if err := os.WriteFile(secret, []byte("do not read me"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	linkDir(t, outside, filepath.Join(workspace, ".zero"))
+
+	paths := DefaultPaths(workspace)
+
+	if _, err := Write(paths, ScopeProject, "escaped", "d", "b"); err == nil {
+		t.Error("Write went through the linked ancestor")
+	}
+	if _, err := os.Stat(filepath.Join(outside, "memory", "escaped.md")); !os.IsNotExist(err) {
+		t.Errorf("a note was written outside the workspace, stat error = %v", err)
+	}
+	if _, err := Read(paths, ScopeProject, "secret"); err == nil {
+		t.Error("Read returned a note from outside the workspace")
+	}
+	if err := Forget(paths, ScopeProject, "secret"); err == nil {
+		t.Error("Forget accepted a target outside the workspace")
+	}
+	if _, err := os.Stat(secret); err != nil {
+		t.Errorf("Forget deleted a file outside the workspace: %v", err)
+	}
+	if notes := List(paths); len(notes) != 0 {
+		t.Errorf("List surfaced %d note(s) from outside the workspace", len(notes))
+	}
+}
+
+// The ordinary path still works, or the test above would pass against a store
+// that refused everything.
+func TestAnOrdinaryWorkspaceStoreStillRoundTrips(t *testing.T) {
+	workspace := t.TempDir()
+	paths := DefaultPaths(workspace)
+	if _, err := Write(paths, ScopeProject, "note", "a summary", "the body"); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+	note, err := Read(paths, ScopeProject, "note")
+	if err != nil {
+		t.Fatalf("Read: %v", err)
+	}
+	if note.Description != "a summary" || strings.TrimSpace(note.Body) != "the body" {
+		t.Errorf("round trip lost content: %+v", note)
+	}
+	if notes := List(paths); len(notes) != 1 {
+		t.Errorf("List returned %d notes, want 1", len(notes))
+	}
+	if err := Forget(paths, ScopeProject, "note"); err != nil {
+		t.Fatalf("Forget: %v", err)
+	}
+	if _, err := Read(paths, ScopeProject, "note"); err == nil {
+		t.Error("the note survived Forget")
+	}
+}