Make pmctl memory canonical across hosts

[screenleon]

What changed

• Route Claude, Codex, and OpenCode preparation/session memory through the strict pmctl resolver and writer.
• Surface canonical provider, project key, memory directory, resolution source, and hit information in prepare/run artifacts.
• Add locked, atomic episode appends and harden both target-file and lock-directory handling against symlink races.
• Add Codex UserPromptSubmit/Stop wiring, shared host naming, documentation, and cross-host regression coverage.
• Track the existing direct-impact planner issue separately as CC-486 instead of mixing it into CC-483.

Why

CC-483 requires one project-owned canonical memory substrate across hosts. Host-native memory may remain auxiliary, but it must not silently override or split the project memory path.

Impact

• Cross-host PM workflows now resolve and write the same canonical store.
• Invalid explicit memory configuration fails closed.
• Prepare and run artifacts make memory resolution observable for debugging and audits.

Root cause and security hardening

Legacy hooks had separate resolver/write paths. During review, the first append implementation was also found to have a symlink TOCTOU window between validation and pathname append. The final implementation uses a protected work directory, hard-link snapshot, temporary file, and atomic rename so a raced symlink is never followed during commit.

Validation

• Authoritative full suite: 77 passed, 0 failed, 0 skipped.
• Focused suites: memory 69/69, PM 30/30, guards 296/296, commands 276/276, Codex host write 36/36.
• Codex full-tier gate identified the append race; the implementation and race tests were updated.
• Claude full-tier gate then returned final GO, with critic, QA, architecture, security, and risk reviewers all approving/passing.

Ticket: CC-483