fix(mcp): enforce scope-safe memory tools

[kunickiaj]

Description

Updates the MCP memory tools so every read and write surface (`memory_search`, `memory_search_index`, `memory_timeline`, `memory_explain`, `memory_expand`, `memory_get`, `memory_get_observations`, `memory_recent`, `memory_pack`, `memory_remember`, `memory_forget`) respects the device's authorized sharing domains by default:

• New `memory-access.ts` helpers route direct-id, getMany, forget, and remember through scope-filtered store paths.
• Filter schema accepts optional `scope_id` / `include_scope_ids` / `exclude_scope_ids` that intersect with authorization.
• `rememberMemoryForMcp` rolls back inside the transaction with `unauthorized_scope` if the resolved scope is not locally visible.

Implements codemem-ov4g.5.4.

Type of Change

• 🐛 Bug fix (fixes an issue)

Testing

• Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test`)
• Added/updated tests for changes
• Manually verified changes work as expected

Coverage: MCP direct reads, getMany filtering, forget refusal on unauthorized scope, remember rollback when scope is hidden.

Checklist

• Code follows project style (`pnpm run lint` passes for touched files)
• Self-review completed
• Documentation updated (if needed)
• No new warnings introduced

[kunickiaj]

• test(core): add retrieval leakage regression suite #1038
• fix(core): enforce scope-aware export import #1037
• fix(api): enforce scope-safe viewer and CLI memory access #1036
• fix(mcp): enforce scope-safe memory tools #1035 👈 (View in Graphite)
• test(plugin): guard scoped OpenCode context injection #1034
• fix(core): harden memory pack scope assembly #1033
• fix(core): scope sqlite-vec semantic retrieval #1032
• fix(core): enforce scope visibility in memory retrieval #1031
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[kunickiaj]

Merge activity

• May 5, 2:59 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 5, 3:12 PM UTC: Graphite rebased this pull request as part of a merge.
• May 5, 3:13 PM UTC: @kunickiaj merged this pull request with Graphite.