feat(mcp): add explicit local agent memory and learning tools

[AlexMikhalev]

Starting the MCP server with an explicit --agent-data-dir /absolute/path now exposes nine typed memory and learning tools backed by the existing Terraphim agent APIs. An authored memory is saved and read back by ID; an observed failure can be annotated separately from an explicit correction rule, whose compiled JSON and synonyms:: notes are returned from actual saved files.

The CLI and MCP server use the same atomic storage transactions and advisory writer locks. The server exposes no agent tools without the flag and refuses this option with SSE. It never executes a captured command, installs a hook, activates a rule or registers an exported graph. Corrupt or unrepresentable records are refused before replacement. See the tool and storage contract.

Prepares workspace version 1.21.22 for the cooperating CLI and MCP binaries, including the separately merged grep single-file fix. The immutable 1.21.21 tag and stage are retained as unpublished failed-candidate history: Linux CI exposed a lock-lifetime failure when a forked child inherited the open file description. The new transaction guard explicitly unlocks before closing. Deterministic real duplicate-descriptor and child-process tests fail with the old behaviour and pass with the fix; no retries, timeout increases or serial test workaround were added.

The replacement client stage passed all 12 jobs in run 38718874679, bound to immutable v1.21.22 source 88a09d8b11e4eab550c6f7410f86faee7cc41ecc. All 47 staged files and 17 archive signatures verify; the package checksum metadata now references only that replacement stage. The MCP prerelease tag will use the normally merged main commit to satisfy its existing ancestry gate. The shared implementation and manifests are compared across those commits, followed by actual released-binary interoperability tests. No source tag or asset is overwritten. External dependency versions remain unchanged by the version bump. This follows the released synonym/role fixes in #65.

Validation:

• Real stdio and CLI interoperability: schemas, default absence, explicit store identity, capture/show/restart, saved-file readback, concurrent requests, busy-lock refusals, malformed inputs and cancellation.
• Actual failed/corrected printf outputs; failure annotation compiles to zero rules, an explicit correction compiles to one mapping and exports real synonyms:: Markdown.
• Shared-store tests cover released-CLI snapshot compatibility, corrupt/symlink/oversized data, repeated failure importance, correction history and Markdown round-trip refusal.
• Rust 1.96 formatting, workspace Clippy with -D warnings, and all-target checks passed. Required CI runs the real shared-store and protocol tests.
• The changed-route tests and isolated agent library tests pass. The broader legacy suite is not represented as fully passing: some tests require an external server or cargo-llvm-cov, and its default DeviceSettings isolation is a separate limitation.

The Arch prepublication gate now verifies the exact successful producer run, immutable artefact identity, all sealed file hashes and existing promotion provenance before caching the two native signed archives. It then runs the unchanged makepkg/build/install/smoke/removal checks. A complete public release selects the normal public-download path; incomplete releases and lookup errors fail closed. The successful initial Arch execution exposed an evidence-upload path translation issue, now corrected with one dedicated receipt directory; final CI must prove all four retained JSON files. Public GitHub/R2 byte readback remains mandatory after promotion.

Older CLI writers do not take these locks; stop them before sharing a store with the new server. This PR does not claim native marketplace-host qualification.

Fixes #64.