chore(docker): add memory config sections to compose configs

[jkyberneees]

Summary

The bundled Docker Compose configs (config.godmode.json, config.restricted.json) shipped without a memory block, so the memory subsystem stayed off in the out-of-the-box container setups. This adds explicit memory sections to both with sensible caps and thresholds, mirroring the transcription block added earlier.

Also broadens the coverage-artifact gitignore (coverage.out → *.out) to catch stray cov.out files from ad-hoc go test -coverprofile runs.

Memory block

"memory": {
  "enabled": true,
  "facts_limit_user": 1500,
  "facts_limit_env": 2500,
  "buffer_lines": 20,
  "buffer_enabled": true,
  "merge_on_write": true,
  "extract_on_end": true,
  "llm_search": true,
  "llm_extract": true,
  "llm_consolidate": true,
  "merge_threshold": 0.7,
  "add_threshold": 0.3
}

The newer safety flags (extract_facts, auto_approve_episodes) are intentionally omitted so they fall back to their secure defaults (false); consolidate_on_end likewise defaults to true.

🤖 Generated with Claude Code

[jkyberneees]

🔍 AI Verification Protocol v5.2.7 — Certificate

Classification: NovelBehavior (config-only; no executable code, no exported-symbol changes)
LOC_filtered: 29 (3 files) — well under the 1,500 standard-pipeline ceiling.

Axes applied (proportionate to a config/docs change)

Axis	Result	Evidence
2.1 Semantic Correctness	✅	Both JSON files parse (json.load); all 12 memory.* keys map to real struct fields (memory.MemoryConfig) and are actively applied by resolveMemory (loader.go:809-862) — no silent no-op keys.
2.3 Security Surface	✅	The two dangerous flags (extract_facts, auto_approve_episodes) are omitted, so they fall back to secure defaults (false). consolidate_on_end defaults true. No new external surface; memory writes stay in-container under ~/.odek.
2.6 Dependency Integrity	✅	No dependency changes.
2.9 Documentation Coverage	✅	No exported symbols added/changed. All tuned keys (merge_threshold, add_threshold, llm_search, buffer_lines, extract_on_end, llm_consolidate) already documented in docs/CONFIG.md.

Signals

• go build ./... ✅
• JSON well-formedness ✅ (both files)
• Config keys parsed and applied: verified against internal/config/loader.go + internal/memory/memory.go struct tags.

Note — pre-existing test finding (NOT introduced by this PR)

go test ./internal/config/... fails on TestLoadConfig_{GlobalFile,ProjectOverridesGlobal,VarExpansion,MissingFiles,InvalidJSON} in the full-package run, but every one of these passes in isolation. Reproduced identically on main via a clean worktree → this is a pre-existing test-isolation defect (process-global ODEK_* env / HOME / CWD state leaking across tests through the env > file merge precedence), independent of this config-only diff. Tracked separately.

Verdict: AutoApprove for the PR contents. No findings to fix in the diff.