feat(memory,P0): scope-preserving nunchi/MemPalace collection for audience-scoped Piri

[seoseo-ai]

Problem

ccc-node PR #948 isolates Piri transcripts and generated bootstrap context under opaque audience roots. The existing nunchi Piri lane still scans one global session tree, while the audience-scoped materializer deliberately disables node-global nunchi injection because no scope-local snapshot/provenance contract exists.

Simply scanning every audience directory would violate the privacy boundary by allowing private DM facts to enter a node-global index.

Live evidence

• PR feat(memory): add Piri round-trip pipeline #948 deployed at exact merge commit 991f18d1c5362b3fc1f4762cb171ce91df1ef3ec on bangtong, soonwook, jingun, and dungae.
• Isolated Piri round-trip succeeded on bangtong/Kimi K3 and jingun/GLM-5.2.
• Production bridges remain CCC_BRIDGE_MEMORY_MODE=off; no real Telegram audience was enabled.
• Body-free rollout record: seoyoon-family-wiki PR #3193.

Acceptance criteria

• Discover only allowlisted audience session roots without persisting raw Telegram IDs.
• Physically partition nunchi facts and MemPalace indexes by opaque private/shared scope.
• Private DM recall reads its private scope plus shared; group/channel recall reads shared only.
• Preserve owner-only storage, bounded ingestion, idempotent seen state, and provider provenance.
• Teach piri-feed, MemPalace refresh, memory status, and doctor to report scoped collection accurately.
• Add synthetic allow/deny tests proving no cross-private or private-to-group recall.
• Keep current global behavior unchanged while audience-scoped collection is disabled.
• Require a fresh operator-approved single-node pilot before production rollout.

Related: ccc-node #948, ccc-node #578, seoyoon-family-wiki #3193, jinwon-int/piri#1.

[seoseo-ai]

Cross-link: provider-neutral distill/readiness is tracked in #951; Piri compaction lifecycle is tracked in jinwon-int/piri#2.