feat: add automatic cross-session memory

[sdsrss]

Summary

• add bounded, redacted, surface-private cross-session handoff capsules across Stop, SessionEnd, and SessionStart
• keep repository MEMORY.md as reviewed durable team memory and document native Codex Memories as the opt-in model-selected layer
• integrate hook registry/manifests, install/uninstall ownership, diagnostics, distribution fixtures, performance coverage, and bilingual documentation
• synchronize the additive release version to 5.2.0

Safety boundaries

• capture only bounded last_assistant_message; do not read separate prompt, tool, patch, or transcript fields
• hash raw session IDs, redact high-confidence secret patterns, replace matching raw/physical repository paths, and treat restored text as untrusted context
• keep plugin and standalone runtime state isolated
• leave live /home/sds/.codex and OPENAI_API_KEY untouched

Fresh validation

• npm run check — passed
• bash qa/conformance-eval.sh --validate — 17 passed / 0 failed
• formal release SLO — pass:true, no violations
• safety coverage — 22 hooks, gap count 0
• package dry-run — 140 entries; capture/finalizer/helper included
• version cascade, changed-route verification, staged secret scan, and diff checks — passed

Evidence limitation

The native Codex real-model canary remains intentionally unverified because OPENAI_API_KEY was not configured or read. This PR does not claim that canary passed.