fix(memory): harden Supabase vector RPC

[EmersonBraun]

What changed

• replace the generic arbitrary-SQL Supabase RPC path with direct PostgREST upsert and delete operations
• restrict vector search to a purpose-specific, configurable RPC (match_agentskit_vectors by default)
• document a bounded security invoker SQL function with explicit grants and least-privilege guidance
• add coverage for the direct operations, configurable search function, filtering, ordering, thresholds and error handling
• add a patch Changeset for @agentskit/memory

Why

The previous integration documented and invoked a generic SQL-execution RPC. That made the database boundary broader than the vector-memory adapter required. This change narrows the adapter to the three operations it actually needs and keeps database authorization under the application's existing Supabase role and RLS configuration.

Validation

• pnpm --filter @agentskit/core build
• pnpm --filter @agentskit/memory test
• pnpm --filter @agentskit/memory lint
• pnpm --filter @agentskit/memory build
• pnpm docs:bridge:gate
• git diff --check
• exact-diff credential scan

[github-actions]

Lighthouse

URL	Performance	Accessibility	Best practices	SEO
http://127.0.0.1:3000/	41	92	96	100
http://127.0.0.1:3000/docs	75	100	96	100
http://127.0.0.1:3000/docs/get-started/getting-started/quickstart	71	96	96	100
http://127.0.0.1:3000/stack	91	100	96	100
http://127.0.0.1:3000/showcase	92	100	96	100

Run by .github/workflows/lighthouse.yml.