Harden canonical memory host contracts

[screenleon]

Summary

• complete Codex canonical-memory read/write lifecycle wiring, including explicit host provenance and a host-owned memory update adapter
• replace the unsafe machine-global dispatch.memory_dir override with project-key-scoped memory configuration, migration, lint, and fail-closed resolution
• isolate memory/config fixtures so parallel affected and full-suite execution cannot mutate the operator's live canonical memory
• expand installer, doctor, manifest, lint, planner, and cross-host regression coverage
• add CC-491 as a separate follow-up for machine-readable pre-flight evidence reuse in PR-gate

Why

The canonical memory data itself was healthy, but Codex live wiring lacked the complete Stop writer contract and natural-language update routing. The existing global explicit memory path also allowed unrelated repositories to resolve to the same canonical store, creating a cross-project write risk.

The implementation now keeps project identity separate from initiating host provenance: Claude, Codex, OpenCode, and future hosts share the same repository-owned canonical store while every write requires an explicit source host.

Validation

• full-tier sequential PR-gate: GO
  • critic: approve
  • qa-tester: pass
  • architecture-reviewer: approve
  • security-reviewer: pass
  • risk-reviewer: pass
• affected pre-flight via bash scripts/run-tests.sh --base main: PASS
• parallel fixture regression:
  • test-pmctl-memory: 74/74
  • test-pmctl-pm: 30/30
• pmctl backlog lint: PASS
• git diff --check: PASS
• live doctor after reinstall: 26 OK, 0 warn, 0 fail
• ~/.claude/statusline-chain.conf remained byte-identical across the required reinstall

Accepted full-suite exception

The authoritative full run completed 76 of 77 suites successfully. The only failure was test-guards, which reached the 900-second suite timeout while blocked in the known CC-487 contention/hang path:

memory-usage/contention-matrix-flock-and-mkdir-fallback

This is an existing tracked nondeterministic runner issue, not a canonical-memory product regression. Running the same suite independently immediately afterward completed successfully with 298/298 passing. Per the accepted CC-487 boundary, this known timeout does not block opening this PR; the full-suite artifact is intentionally not described as fully green.

Follow-up

CC-491 tracks a separate mechanical evidence contract so PR-gate can pass commands, selected suites, per-suite outcomes, and tree fingerprints to QA reviewers without redundant test execution.