[iHow1]

What this changes

Adds a bounded Core contract for the separately published dsh-ihow-memory adapter:

• exposes DSH lifecycle capability evidence and configure_runtime / runtime_event adapter methods;
• supports session-start handoff injection, first-step prompt recall, after-turn observation, metadata-only compaction checkpoints, and partial session-end checkpoints;
• records configuration and lifecycle evidence without persisting raw prompts, session IDs, summaries, or transcript bytes;
• keeps DSH Profile installation and Host hook wiring outside Core.

Verification

• npm run build passes locally
• npm test passes locally: 213 tests, 211 passed, 2 documented Hermes-checkout skips, 0 failed
• npm run typecheck passes locally
• node scripts/proof.mjs passes (governed loop intact)
• npm run release:evidence:check passes on committed tree d2653eda5bf338574ccc6061961ca9ec5ea3f194
• No customer data, private memory content, real paths or credentials in any file
• Synthetic data only in tests and examples
• This change contains no private product code or internal strategy
• DCO sign-off is present on every commit
• License and trademark boundary remain unchanged
• CHANGELOG.md updated

The CI-only public-boundary secret scan was not reproduced locally because IHOW_PUBLIC_BOUNDARY_DENYLIST is intentionally unavailable outside repository secrets; the test suite verifies the fail-closed behavior when it is absent.

Release boundary

This PR prepares ihow-memory@0.1.0-alpha.33. It does not publish npm, install the DSH plugin, or change any already-running frozen runtime.