Persist payload-free lifecycle receipts for forget and redaction

[TerminallyLazy]

Context

Raised by bio1-aws in Shiyao-Huang/awesome-agent-evolution#18 while comparing physical deletes with logical tombstones. The current implementation deliberately supports both, but exploratory validation found an audit gap: tree-ring forget --reason requires a nonblank reason and then discards it.

Source discussion: Shiyao-Huang/awesome-agent-evolution#18 (comment)

Current behavior

• --mode delete physically removes the memory row, matching FTS row, operation claim, and redaction tombstone in one transaction.
• --mode redact overwrites the payload and identifying/correlation metadata with a sanitized [REDACTED] row, updates FTS to sanitized content, and retains a memory-ID tombstone that blocks payload restoration.
• Supersession is a separate logical lifecycle operation that preserves the old row and excludes it from default recall.
• Coordinated-mode authorization audit records authorization decisions; it is not a complete lifecycle receipt and does not preserve the operator-supplied forget reason.

Required outcome

Design and persist a payload-free lifecycle receipt without weakening hard-delete/privacy semantics.

Acceptance criteria

• Forget/redact records action, timestamp, safe target identifier or hash, actor/origin when available, and a validated operator reason in the same transaction as the mutation.
• The receipt never retains summary/details/source text or secret-like reason content.
• Hard delete still removes the memory and FTS payload completely.
• Redaction tombstones and lifecycle receipts remain distinct concepts.
• FTS indexes only live/sanitized memory rows, not receipts, and parity tests remain exact.
• Audit/export surfaces can inspect lifecycle receipts with a documented retention/removal policy.
• Schema migration and old-client fencing are explicit and tested.
• CLI/TUI/Agent Zero callers round-trip the supplied reason rather than silently discarding it.