Add mem0 mutation assurance proof

[creatornader]

Summary

• Add a host-side mem0 mutation helper built on @atrib/action-gate.
• Run a real mem0ai/oss@3.1.0 proof that blocks identity-scope metadata, verifies an allowed update, and checks delete state.
• Keep public records hash-only while local sidecars retain private memory arguments.
• Document the boundary between mem0, atrib evidence, host authority, and OpenTelemetry tracing.

Why

A mem0 success response and the resulting memory state are separate facts. The helper signs the policy decision before a mutation and requires at least one read-back check after execution. A missing, failed, or false postcondition cannot be reported as verified.

Verification

• pnpm --filter @atrib/integration typecheck
• pnpm --filter @atrib/integration test -- mem0-mutation-assurance.test.ts (6 passed)
• pnpm --filter @atrib/integration mem0-mutation-assurance
• pnpm doc-sync
• Prettier and git diff --check

The full integration run reached 59 passing files and 246 passing tests, then two unrelated browser tests exceeded their existing 30-second limits. Both also timed out in isolation. Targeted ESLint could not start because the current TypeScript 7.0.2 and typescript-eslint 8.64.0 combination crashes inside typescript-estree before file analysis.