Agent memory

Memory is a trust feature: every scope has its own switch; the Agent only writes memories you approve; disabled scopes are never injected into context.