Add connected-local Cloud support and Core runtime improvements

[ethanj]

Summary

Add connected-local support to self-hosted Core so a Docker-deployed instance can link to Atomic Memory Cloud using Cloud-issued JWTs, content-free trace sync, and heartbeat reporting. This also delivers Core 1.2.0 runtime, performance, and reliability improvements while preserving local-only deployments and the existing CORE_API_KEY contract.

Changes

• Add dual authentication supporting the existing CORE_API_KEY and verified Cloud-issued RS256 JWTs, with user and project binding that rejects cross-user or cross-project access.
• Add durable Cloud trace sync through a PostgreSQL outbox, allowlisted content-free envelopes, retry and dead-letter handling, backlog limits, and authentication recovery.
• Add heartbeat reporting and a stable connected-local instance identity.
• Auto-generate and persist a local CORE_API_KEY when needed, preserve explicit key overrides across restarts, apply connected-local Docker defaults, and provide a helper for retrieving the persisted key.
• Add EMBEDDING_DTYPE configuration for quantized local embedding models.
• Add bounded parallel reconciliation and a background scheduler for deferred AUDN work.
• Enforce Anthropic JSON output using assistant prefill.
• Restrict idempotent re-indexing to valid extraction-status transitions.
• Add a repository-guarded prerelease Core image lane with per-platform verification, runner disk management, curated aliases, and structural policy enforcement. The lane remains disabled in this public repository.
• Bump @atomicmemory/core to 1.2.0 and add jose for JWT verification.

Why

Connected-local mode lets operators link self-hosted Core to a Cloud project without sharing the local API key. Local SDK and CLI access remains unchanged, and outbound trace sync is explicitly enabled and excludes memory and query content.

The additional Core improvements make larger local embedding models practical, reduce deferred-work latency, strengthen structured LLM output, and correct restart and re-indexing behavior.

Validation

• Added JWT configuration, dual-authentication, user-binding, heartbeat, trace sanitization, trace-sync, outbox, and deferred-scheduler tests.
• Added JWKS-backed integration coverage for cross-user rejection and reconcile scoping.
• Extended Docker smoke coverage for generated and operator-supplied API-key persistence.
• Verified the Core package build, type checking, linting, packaging, metadata, security, repository hygiene, and Docker image build and boot.
• Image-publisher policy suite passes 43/43 tests.
• All 11 release-preparation and post-merge CI checks pass.