fix(memory): journal the index accounting, and stop three ways of losing it (#1447)

[ozand]

Closes #1447.

The issue asked for one thing: get memory_index onto the ledger. Probing the path before editing turned up two further defects in the same function, both more severe than the one filed.

1. The record went stale, which is worse than absent

When memory/index.md was deleted, get_memory_context returned "" without touching last_index_fit, so the record kept the previous build's byte counts. A cycle with no memory would have journalled another cycle's accounting as its own. Verified before fixing:

after deleting the index -> context: ''
last_index_fit: STALE, source_chars=3654

Wrong data presented as current is a worse failure than no data.

2. An unreadable index raised out of prompt construction

undecodable index RAISES: UnicodeDecodeError 'utf-8' codec can't decode byte 0xff

memory/index.md is instance-owned. The loop could fail its own cycle by writing one bad byte into its own file. ADR-002 / #1173 is explicit that an unreadable input is a value, not an exception.

3. An allowlist ate the signal added by #1443

ContextBuilder copied six named keys out of the record. #1443 added resident_matched / resident_expected / resident_missing after that list was written, so the report that a rule entry stopped matching never reached a caller at all — the guard's output was filtered out on the way to its reader. Copying the whole record removes the class rather than this instance of it.

What changed

last_index_fit now always carries a status: present / missing / empty / unavailable, with the exception type as reason for the last. Those four are exactly the states ADR-002 requires a caller be able to tell apart.

The bridge journals memory_index on the phase: "system_prompt" row alongside sections, never instead of it — existing readers of sections.memory are untouched, pinned by a test.

Grouper safety, checked not assumed

This adds a key to an existing row rather than a new phase, but #1374 is the precedent for new keys minting phantom entries. scripts/loop_metrics_report.py:160 allowlists phases (the #1374 ratchet) and every outcome reader filters phase == "outcome" explicitly, so nothing keys on the presence of a system_prompt field.

Tests

Six new. Five fail against the unfixed sources — verified in an isolated copy, not by stashing. The sixth is the sections behaviour-preservation test, which must pass in both states and does.

Full suite: 4 failed, 3595 passed, 18 skipped. The four are the known Windows baseline, failing identically on a clean origin/main.