[memory] Local store, wired recall, and one explicit writer #293

Context

Roadmap B1 and B2 — see docs/roadmap.md
and the anchor issue #168. The capability exists and is inert: agent/memory.go implements
Remember/Recall/Forget/List against a remote HTTP service, Agent.Memory is declared and read
at the top of Run (agent/agent.go:457), and nothing anywhere calls it — no caller of Remember,
no assignment of Agent.Memory, no memory key in any config file.

docs/memory-decision.md (merged) fixes the v1 write path: one writer, a /remember command the user
types; automatic end-of-turn extraction waits for B3. This issue is the work that decision unblocks.

The two roadmap entries are one unit of delivery on purpose: wiring recall without a store that can hold
anything ships a feature that recalls an empty list forever, and a store without a caller ships a
backend nobody reads. Splitting them creates that in-between state.

What to build

S1 — config and the layer gate.
config.MemoryConfig (enabled, backend, dir, max_entries, max_bytes, recall_limit,
base_url, bank) with defaults enabled: true, backend: "local"; a MemorySpec() resolver in the
shape of TrajectorySpec(); and UserLayer.ResolveMemory, which honours an egress request (a
network backend, or any base_url) only when the user's own ~/.tinycode/config.json asked for it —
a project-local .tinycode/config.json that tries is ignored and the ignore is logged, exactly as
UserLayer.ResolveTrajectoryCapture does for capture: full. config.example.json gains the section
with a $comment saying what leaves the machine.

S2 — the local store.
agent/memory_local.go implementing types.MemoryStore over a JSONL file at
<dir>/<project-hash>.jsonl (default dir ~/.tinycode/memory, 0600), one line per entry:

• id = first 16 hex of sha256(key NUL value), so Remember is idempotent;
• types.Memory gains ID, Source and CreatedAt; MemoryStore.Forget takes the id List
  returns (the parameter is renamed; there are no callers to migrate);
• bounds: max_entries (default 2000) and max_bytes (default 8 MiB), oldest dropped first by
  rewriting the file through a temp file and a rename;
• recall is lexical — lowercase tokenisation, a small stopword list, tf-idf over the store plus a
  recency tiebreak, top recall_limit (default 5) above a minimum score. No new dependency, and no
  pretence of semantics: that is B3;
• Forget really deletes; the Hindsight no-op must not be the model for this backend;
• in-process sync.Mutex serialises writers. Cross-process safety is a single-line append and nothing
  more — a compaction that races another process can lose a queued line. That limit is recorded here,
  not silently assumed away.

S2b — the store is not a tool path.
tool.SetMemoryRoot plus a refusal in CheckPathAccess, mirroring tool/trajectory_store.go: a
memory the agent can rewrite is not a memory. The default dir lives outside the project root, and a
tool that tries to write it is refused with the same wording as the trajectory and checkpoint stores.

S3 — wiring and commands (its own PR, after this one). S4 (Hindsight contract) and S5 (docs) are
listed in the slices above this issue's first PR and are not part of it.

Acceptance

• UserLayer.ResolveMemory returns ignored=true for a project-local egress request, and the merged
  config still resolves to the local backend.
• The store survives a reopen: write two facts, construct a second instance over the same directory,
  List returns both.
• Remembering the same (key, value) twice leaves one entry.
• Past max_entries, the oldest entry is gone and the newest are all present.
• Forget(id) removes exactly one entry, and a reopened store does not return it.
• Eight concurrent Remember calls all land (no lost line).
• tool.CheckPathAccess refuses a write beneath the memory root with the reserved-store wording.
• go test ./... -count=1, -race, gofmt -l, go vet, staticcheck clean.

Out of scope

Automatic summarisation (see docs/memory-decision.md for the reopen condition), embeddings and vector
search (B3), memory as a model-callable tool (#188), an approval queue, cross-project memory sharing,
and cross-process locking.