feat(memory): enforce capacity budgets for long-lived Memories

[222twotwotwo]

Which issue or RFC does this PR close?

Closes #1718

Rationale for this change

#1709 removed projection write amplification, but each Memory Revision still stores a complete manifest. Inactive entries remain as tombstones, writes have no explicit entry or byte ceiling, and callers cannot inspect remaining capacity.
This PR adds observable capacity budgets and deterministic refusal when a write exceeds them. Explicit tombstone compaction lets operators recover current-manifest capacity while preserving historical content and exact citations.

What changes are included in this PR?

• Enforce active-entry, manifest-entry, and canonical-content byte budgets across Memory writes and generic Artifact management. Rejected writes leave the stored Memory unchanged.
• Add POST /v1/memory/capacity, Runtime and Python client access, and generated Python/JavaScript contracts.
• Add in-process compact() with dry-run, batch limits, a recovery window, tag protection, and per-entry audit changes. Compaction preserves entry bodies and historical revisions and writes zero projection rows.
• Bound MemoryService.revisions() expansion and apply requested revision bounds in backend history queries.
• Add behavior regressions, SQLite/OceanBase scale benchmarks, and English/Chinese documentation.
  This implements the explicit-failure option in feat(memory): define capacity contract for long-lived Memories #1718. Physical erasure and retention policies remain under RFC: define retention, erasure, and lifecycle policies #1425; entry and history pagination remain under feat(memory): add bounded cursor pagination for Memory entries #1656 and feat(memory): add bounded pagination for Memory changes and history #1657.

Are there any user-facing changes?

Yes.

• Default budgets are 5,000 active entries, 10,000 manifest entries, and 4 MiB of canonical Revision content, including change records.
• A write that grows an over-limit dimension returns HTTP 409 memory_capacity_exceeded, with dimension, limit, and observed details. For example, appending a second entry under a one-entry manifest budget is rejected without advancing the head.
• forget() and organize() remain available over budget. reactivate() checks active-entry growth.
• Compaction is disabled by default and requires an explicit in-process call when enabled. Dry-run is available while disabled. Compacted entries cannot be reactivated, but their historical citations remain valid.
• MemoryService.revisions() rejects expansion beyond 100 revisions by default; exact revision reads remain available.
• Custom MemoryBackend implementations must provide any_tagged_entry_ids(). Consumers that exhaustively enumerate change operations must handle the new compact value.
  No database schema migration is required. The budgets constrain current Revision content and history-read expansion; retained historical data continues to consume storage.

How was this change tested?

Focused capacity, service, persistence, HTTP/client, and API contract regressions:
uv run --locked --no-sync python -m pytest
tests/builtin/artifacts/memory/test_capacity.py
tests/builtin/artifacts/memory/test_service.py
tests/e2e/test_memory_capacity.py
tests/test_api_contract.py
tests/test_js_operations.py
tests/builtin/persistence/test_memory.py -q
80 passed, 13 skipped. The skipped cases require an OceanBase connection.

• Separate local OceanBase capacity validation: 13 passed without skips.
• Regression coverage verifies deterministic refusal without mutation, recovery from a full manifest, tag protection and concurrent-tag rollback, preserved historical citations, the history-read boundary, and incremental projection writes.
• SQLite and OceanBase scale runs covered 200, 1,000, and 5,000 entries. Both completed the compaction cycle, removed 4,000 tombstones, wrote zero projection rows during compaction, and preserved the sentinel search-hit identity. Backend measurements are documented separately in the benchmark README.
• Python and JavaScript API generation consistency checks passed.
• Ruff, formatting, changed-source type checks, lock-file validation, and git diff --check passed.
• uv run --locked --no-sync ty check --python-platform linux passed.
  Full repository CI remains pending.

AI usage statement

Codex assisted with code review, documentation updates and validation.