feat: archive invalid memories

[faj-design5260]

Invalidating a memory moves it from the active tree into archive/memories/, preserving content, identity, provenance and explicit history access. Normal Recall, Read and Context exclude invalid memories.

Lifecycle contract

• Delete, supersession and Manage invalidation use the shared Store persistence path.
• Invalid content is prepared in a temporary archive file. The unchanged active file moves first; invalid status is then committed at the archive path. If the move fails, the source remains active. If the status replacement fails, the original bytes move back. A pre-existing destination raises FileExistsError without overwriting either file.
• A single Store supersede rolls back its candidate when predecessor archival fails. A multi-memory Manage merge remains a sequence of individual writes.
• Rebuild keeps archived history available to explicit include_invalid / --history and temporal --as-of access without adding it to default retrieval. Raw evidence and provenance remain available. No bulk migration or production data operation is included.

Evidence

• Archive contract, Recall, Context, index/rebuild, Manage, supersession and CLI/MCP regression suite: 123 passed.
• Full pytest: 406 passed. Ruff, mypy (66 source files) and git diff --check: passed.
• The Phase A failure and fix, contract tests, and commands are recorded in experiments/runs/archive-management-12-20260916/phase_a_b_report.md and phase-a-fix-gates.log.
• Three source-grounded targeted answer probes compared Baseline and Archive for Negroni 5→10, Crash Course videos 12→15, and Ticket to Ride 124→132. Both arms answered 3/3. All six runs used mem context; none read the old invalid file through direct read or filesystem fallback, and Recall/Read ID sets did not change. NO E2E-SENSITIVE PATH FOUND in these probes. No answer-quality improvement is claimed, and no 12/24-question expansion is proposed.

Agent management changes originally included in this PR were split into #31 for independent review. This PR keeps its original base and head history; the atomicity fix is an additional commit.