feat: integrate Agora Memory v2

[zhuqingyv]

Implements the MA product and runtime side of #41 (and the MA portion of #39).

Delivered

• Memory-first TUI: named Memory CRUD, 0..N mounts, per-project/session/user scope, history and CAS rollback.
• Mixed multi-target intake: create + increment in one Agora batch, per-target completed/noop/review/conflict/failed handling, unresolved-only retry and explicit abandon.
• Automatic incremental intake: explicit target ids, 4-user-turn / ~2000-token threshold, 60-second idle gate, persistent source/checkpoint/batch state, no transcript pollution or input blocking.
• Verified request-boundary hot swap: pending selection becomes mounted only after a later chat returns the ordered patch ids and a higher PatchSet revision.
• Context Usage remains sourced from agent.getContextUsage() and independent from Memory lifecycle.
• Shared AgoraMemoryController used by TUI, slash commands and agent tools; v2 never calls legacy intake/lineage APIs.
• Exact optional dependency @zimoos/agora@0.2.0, npm-installed runtime discovery, capability handshake, Developer ID validation, pinned notarization/manifest lock and portable runtime lock.
• Name-first docs and PRD committed at docs/prd-ma-agora-memory-v2.md.

Validation

• npm test: 387 tests, 382 passed, 0 failed, 5 intentional conditional skips.
• Explicit PTY lane: 3/3 passed, including 80-column Memory v2 console and independent Context/Memory lines.
• Visual Playwright lane: 2/2 passed.
• TypeScript build passed.
• Real source MCP v2 E2E: duplicate-name rejection, one-source/three-target intake, none→A→A+B+C→B+C→none hot swap, increment preserving overlays, rollback, disable, stable process/base object/load count.
• Real packaged Agora + Qwen2.5-7B: chat→resident internalization→mount→chat with one resident base.
• Candidate npm installation functional E2E: MA + both Agora tarballs return a real Qwen answer through the development path; the production resolver now deliberately rejects that ad-hoc candidate until published/notarized evidence is synchronized.
• Agora npm tarballs contain no .py, .pyc, .js, source maps, private keys or debug symbols; platform payload is Mach-O/dylib/metallib/manifest only.
• Hash tampering is rejected by the native launcher.

Agora defects found and fixed upstream

• Dynamic compile layer for smaller whitelist models: zimoos/agora 5cee674, integrated as d17f548.

• Empty PatchSet no longer binds an incorrect hook ABI before first mount: 22c2bc4, integrated as a792109.

• Native launcher requires Memory v2 multi-target capability: 9805c56, integrated as acb294c.

• Banner and MCP initialize now report the actual package version instead of a stale hard-coded value.

Remaining release credentials

The functional implementation is complete. This PR stays draft until the exact final artifact is Developer ID signed/notarized and published:

• macOS currently reports 0 valid code-signing identities.
• npm currently reports ENEEDAUTH.
• The local package is ad-hoc signed for functional and tamper testing, not Developer ID signed.
• Signing changes the binary and therefore the manifest SHA/npm integrity; final lock values must be refreshed after signing and publication. Agora PR Provider 超时与重试策略：默认 3 分钟超时，最多重试 5 次 #22 now contains an idempotent build→Developer ID→notarytool→Gatekeeper→npm publish evidence runner, and MA contains npm run sync:agora-release -- <release-evidence.json>, which refuses unpublished/ad-hoc evidence.