feat: add memory policy foundation

[wbugitlab1]

Summary

• Adds a persisted memory policy foundation (mem:policy) with typed policy, query-expansion, write-policy, and preflight-rule structures.
• Registers internal mem::policy-get, mem::policy-update, and deterministic mem::policy-expand-query functions.
• Adds tests for default policy shape, normalization, partial-update preservation, timestamp stability, scoped/disabled expansion rules, query caps, and empty-query rejection.

Scope

Refs #520.

This is intentionally a Phase 1A slice of upstream PR 679. It does not add REST endpoints, MCP tools, shadow write candidates, readback verification, viewer UI, or automatic durable writes. Those remain separate approval/workflow slices because they change externally consumed API or memory-write behavior.

Verification

• corepack pnpm exec vitest run test/memory-policy-types.test.ts test/memory-policy.test.ts --exclude test/integration.test.ts
• corepack pnpm test
• corepack pnpm run build
• corepack pnpm run lint
• git diff --check origin/main...HEAD
• semgrep scan --config p/default --error --metrics=off .
• gitleaks protect --staged --redact
• gitleaks detect --source . --redact --no-git

Notes:

• Semgrep reported 0 findings; one unrelated rule timed out on integrations/hermes/__init__.py.
• Current staged/current-tree Gitleaks scans found no leaks. A full Git-history scan found historical findings that are not present in this branch's current worktree or staged content.