feat(ingest): agent.v1 KnowledgeUpdate -> AtomSpace (System Graph memory)

[mdheller]

Closes the graph-memory half of consent-plane loop #2: a node agent's observations (TurtleTerm turtle-netwatch) become queryable HellGraph memory instead of a KnowledgeUpdate delta written to a sink nothing consumes.

What

• ts/src/agent-graph-ingest.ts — ingestKnowledgeUpdate(doc, g = getHellGraph()) reads the netwatch KnowledgeUpdate (patch.nodes[{id,kind,attrs}] + patch.edges[{from,rel,to,via,severity,ts}]) and writes via the supported façade path (as acr.ts does): addNode(id, [kind, ${graph}Graph], {...attrs, graph}) / addEdge(rel, from, to, {via, severity, ts, graph}) into the SYSTEM graph.
• bin/hellgraph-agent-ingest — reads a KnowledgeUpdate from a file arg or stdin, ingests into the process HellGraph singleton, prints {ingested:{graph,nodes,edges}}. Exported from index; dist rebuilt.

Proof

• ts/src/agent-graph-ingest.test.ts — a sample KnowledgeUpdate produces the expected Process/Host/Port nodes + CONNECTS_TO edge (relation stored as edge.label); tolerant of an empty/malformed patch. Both pass; typecheck clean; npm run build succeeds; the bin ingests end-to-end ({nodes:2, edges:1}).

Ingestion is memory, not a security mutation — it does not gate or refuse (fail-soft), unlike the consent/Governor gates (fail-closed). The turtle-netwatch graph --ingest wire (discover hellgraph via $HELLGRAPH_HOME → sibling ~/dev/hellgraph, fail-soft) follows in a TurtleTerm PR.

[mdheller]

Adversarial self-review + local CI verification (Copilot did not post; the self-hosted gating jobs were freshly unblocked by #48 and were still queuing):

• Reviewed full diff: new agent-graph-ingest.ts + test + bin + index export only; defensive (skips nodes/edges missing id/kind/rel), tolerant of empty/malformed patch, ingestion is memory not a security mutation.
• Verified the REQUIRED build-and-verify-dist guarantee locally: npm run build (tsup) yields no diff on ts/dist — committed dist is in sync with src (the exact assertion the check makes).
• node --test agent-graph-ingest.test.ts → 2/2 pass; tsc --noEmit clean.
  On-thesis: this is the governed write path landing a node agent's observations into queryable AtomSpace (System Graph) memory — the shared substrate under the identity + proof fabrics. Merging (required-check guarantee locally verified; runner lag is infra).