fix: repair memory FTS and reconcile stale missions

[jason-allen-oneal]

Summary

• migrate state to schema v4 and correct the FTS5 external-content column from the nonexistent tags field to tags_json
• rebuild and rank-1 integrity-check the derived memory index while preserving authoritative memory rows
• add an exact-allowlist, idempotent ares mission reconcile-state repair for completed historical missions left marked running
• keep the default reconciliation preview genuinely read-only with a non-initializing SQLite mode=ro connection
• contain corrupt-database failures inside the CLI guard without tracebacks or local path disclosure

Safety boundary

The command refuses missing runs/sessions, incomplete missions or tasks, extra runs sharing a requested session, unexpected lifecycle state, duplicate IDs, and concurrent row-count changes. Preview does not create or migrate a database. --apply records an administrative reconciliation timestamp and explicitly states that the historical completion time was unavailable.

This PR does not modify live state automatically.

Verification

• exact head: bed4532ec9c964b0631d4f582ad5ea681f65a0fb
• fully isolated complete suite: 490 passed, 1 skipped, 11 subtests passed
• focused post-review state suite: 27 passed
• critical Ruff selectors and git diff --check: passed
• schema-v3 preview regression: database bytes and nanosecond mtime unchanged
• missing-database preview regression: refused without creating a file
• disposable copy of the current live state: 141/141 memory rows indexed after migration; FTS external-content integrity passed
• disposable reconciliation proof: 12 runs and 4 exact sessions repaired; second apply changed 0/0; unrelated running session 117 unchanged

Live /home/rev/.ares/state.db remains at schema v3 and has not been changed by this work. A fresh consistent backup and exact preflight will precede the requested local apply after merge.