Add content_class to provider contract and require it in Hermes

[ethanj]

Summary

Add a content_class field to the verbatim ingest contract in the provider-contract schema, and require the Hermes atomicmemory_conclude tool to supply it before storing a fact.

Changes

• Add a ContentClass enum (summary, redacted, raw) and a content_class field on VerbatimIngest in the provider-contract v1 schema.
• Forward content_class through the Hermes Python SDK client's ingest_verbatim call.
• Add content_class to the atomicmemory_conclude tool schema as a required parameter; reject calls that omit it or pass an unrecognized value at the tool boundary, with an error naming the parameter and valid options.
• Add schema tests covering accepted, rejected, and unknown content_class values, plus provider tests covering the new tool-boundary validation.
• Bump plugin package versions to 0.2.0 to reflect the breaking tool-contract change.

Why

AtomicMemory Core's raw-content policy (default: reject) refuses a verbatim write that doesn't declare a content sensitivity class. Previously, the Hermes conclude tool sent unclassified writes, which core rejected with a 422 and no indication of which tool call was responsible. Requiring content_class at the tool boundary fails closed with a clear, attributable error instead. The class is never inferred by the plugin — the caller must choose it, so a raw transcript can't be silently relabeled as hosted-safe.

Validation

• Added provider-contract schema tests exercising accepted content_class values, rejection of unknown values, and rejection of unrelated unknown fields (packages/sdk/src/memory/__tests__/provider-contract-schema.test.ts).
• Added Hermes provider tests covering forwarding of caller-chosen content_class, rejection of a missing value, and rejection of an invalid value (plugins/hermes/tests/test_provider.py).