feat(runtime): add synthetic Gate B-M memory-only access plane

[DanielJD1216]

Summary

• add an internal synthetic Gate B-M memory-only access plane with immutable server-derived principal, adapter, client, session, credential, lifecycle state, audience, namespace, capability, epoch, destination, and five-hop audience-chain context
• enforce sender proof before policy evaluation, exact synthetic DPoP or mTLS metadata binding, a 15-minute credential lifetime ceiling, active credential/session state, bounded one-process replay denial, exact destination schema, and payload-authority rejection before retrieval
• compose authorization directly in front of the existing audited trusted-memory executor using its receipt-compatible credential actor reference
• add an internal gate_b_memory_only MCP profile advertising only search_trusted_memory, while preserving the existing local memory_only proposal-plus-search contract and provider profile, enforced by a closure-private raw MCP server and frozen null-prototype capability facade with exact allowlists
• add dedicated Gate B-M scope and mutation gates with TypeScript AST validation of MCP registration control-flow and indirection, runtime-profile unit tests, SHA-256-pinned exact memory-only discovery proof, content-triggered Gate A applicability, active-issue approval tracking, documentation, and CI wiring

Closes #288.

Scope boundary

This is the first synthetic Gate B-M memory-only vertical slice. It is not full Gate B exit.

Included:

• synthetic policy and transport fixtures only
• in-process access-plane and protected-search composition
• stdio MCP discovery restriction
• deterministic denial, integration, and scope-mutation tests

Not included or authorized:

• signed OAuth/OIDC or cryptographic DPoP verification
• real TLS or mTLS handshakes
• durable PostgreSQL replay/session coordination
• release-time access-plane reauthorization or expanded receipt binding
• Streamable HTTP MCP or any network listener
• evidence mode, PostgreSQL 18, model service, or live connectors
• deployment, private data, production activation, package publication, release, or managed hosting

Verification

• npm run ci:check
• npm run runtime:gate-b-memory-only
• npm run runtime:gate-b-memory-only:scope
• npm run runtime:gate-b-memory-only:scope:smoke
• npm run runtime:global-owner-hosted-v1-architecture:scope
• npm run owner:open-issues-status
• npm run owner:open-issues-status:smoke
• npm run docs:command-setup
• npm run publish:readiness
• npm run package:dry-run
• PR-event and all-zero initial-push scope fixtures against both Gate A and Gate B-M collectors
• git diff --cached --check

Focused Gate B-M result: 24 passed, 0 failed. The full Alpha runtime result is 179 passed, 0 failed. The focused suite includes the real default executeTrustedMemorySearch protected-read receipt path, exact profile resolution, existing local memory-only discovery compatibility, closure-private capability-facade enforcement, prototype-escape denial, and real MCP discovery.

The existing dependency audit remains at two moderate findings in the MCP SDK's nested @hono/node-server. This PR does not change dependencies, enable HTTP transport, support Windows, or add static serving. The existing time-bounded security disposition remains unchanged.

Review notes

• initial independent review found and blocked receipt actor-reference mismatch, invalid-clock fail-open behavior, sender-proof ordering, missing adapter audience hop, dirty/branch scope bypasses, and incomplete MCP mutation scanning
• those findings were corrected and full CI rerun before final re-review
• full Gate B-M and Gate B exit remain blocked
• Gate C operation remains separately blocked
• deployment and private data remain blocked