feat: add governed graph observations

[wolverin0]

Outcome

Implements PPR-7 governed graph observations behind an off-by-default generation flag and opt-in recall.

Governance and behavior

• Deterministic exact-signature union-find discovery per scope and tenant
• Hub suppression, component bounds, replay fingerprints, SQLite-only migration 0020
• Strict evidence-bound synthesis with max three calls per scope/cycle
• Candidate-only creation and deterministic observation-specific steward promotion
• Immediate archive/stale transitions when active support changes
• Observations excluded from graph extraction and ordinary recall
• Opt-in Python/CLI/MCP recall, bounded packing, dashboard, and disposable demo
• Gemini extraction plus GLM consolidation/provider path preserved; no OpenAI switch

Evidence

• Full non-ML suite: 4463 passed, 72 skipped, 97 deselected, 1 xfailed
• PPR-7 focused tests: 18 passed
• Retrieval/restore gates: 17 passed
• Release/supply-chain contract tests: 86 passed
• Ruff: clean
• Collection: 4633 tests
• Offline corpus: 48 cases, structural precision=1.00, recall=1.00
• Clean wheel: build + Twine + fresh venv install + init-db + demo pass
• Wheel SHA-256: E38CAF30D738B38F5473B20161882E675ECE7FFDFC9D9EDB6B7EB49FFCA22FC0

Rollout boundary

The feature is merged/deployed feature-off first. Candidate generation remains disabled until MEMORYMASTER_GRAPH_OBSERVATIONS=1; ordinary recall remains unchanged unless include_observations is explicitly requested. A 24-hour observation is post-implementation rollout evidence, not an implementation prerequisite.