fix: scope memory upserts by tenant and user

[NeerajCodz]

Motivation

• Prevent a cross-user overwrite vulnerability where caller-supplied memory id could replace another user's record by ensuring upserts are scoped to the tenant/user partition.
• Harden the Postgres upsert path to avoid implicitly moving ownership of an existing row to a different tenant or user when id collisions occur.

Description

• Change TestMemoryStore::upsert_memory to match existing records by tenant_id, user_id, and id instead of id only to preserve per-tenant/user isolation.
• Add a WHERE clause to the ON CONFLICT (id) DO UPDATE statement in the Postgres adapter so updates apply only when the existing row matches tenant_id and user_id, and return a Conflict if no rows were affected.
• Add a regression test local_store_upsert_scopes_caller_supplied_ids_to_tenant_and_user that ingests two records with the same caller-supplied id under different users and verifies both records remain isolated.
• Minor test formatting tweak to a telemetry assertion for readability.

Testing

• Ran the focused test cargo test local_store_upsert_scopes_caller_supplied_ids_to_tenant_and_user, which passed.
• Ran full test suite with cargo test, and all tests passed.
• Performed git diff --check to validate no whitespace/errors introduced, which reported no issues.

---

Codex Task