## Summary
Add a `content_class` field to the verbatim ingest contract in the provider-contract schema, and require the Hermes `atomicmemory_conclude` tool to supply it before storing a fact.

## Changes
- Add a `ContentClass` enum (`summary`, `redacted`, `raw`) and a `content_class` field on `VerbatimIngest` in the provider-contract v1 schema.
- Forward `content_class` through the Hermes Python SDK client's `ingest_verbatim` call.
- Add `content_class` to the `atomicmemory_conclude` tool schema as a required parameter; reject calls that omit it or pass an unrecognized value at the tool boundary, with an error naming the parameter and valid options.
- Add schema tests covering accepted, rejected, and unknown `content_class` values, plus provider tests covering the new tool-boundary validation.
- Bump plugin package versions to `0.2.0` to reflect the breaking tool-contract change.

## Why
AtomicMemory Core's raw-content policy (default: reject) refuses a verbatim write that doesn't declare a content sensitivity class. Previously, the Hermes `conclude` tool sent unclassified writes, which core rejected with a `422` and no indication of which tool call was responsible. Requiring `content_class` at the tool boundary fails closed with a clear, attributable error instead. The class is never inferred by the plugin — the caller must choose it, so a raw transcript can't be silently relabeled as hosted-safe.

## Validation
- Added provider-contract schema tests exercising accepted `content_class` values, rejection of unknown values, and rejection of unrelated unknown fields (`packages/sdk/src/memory/__tests__/provider-contract-schema.test.ts`).
- Added Hermes provider tests covering forwarding of caller-chosen `content_class`, rejection of a missing value, and rejection of an invalid value (`plugins/hermes/tests/test_provider.py`).