Remembra 5.5.1 — log field-policy fixes

Remembra 5.5.1 — a patch release for two defects in the log field policy
introduced by 5.5.0.

Both were found by a post-release audit that enumerated every logEvent field
name in the tree and diffed it against the policy's lists, rather than by reading
the code — in both cases the call site looks perfectly correct.

npm install @hilbras/remembra@5.5.1
pip install hilbras-remembra==5.5.1

---

A documented diagnostic was silently removed

file sat on the blanket drop list alongside path and root. So
memory_parse_skipped and memory_normalized stopped emitting the file field
that the documentation advertises:

5.5.0  {"event":"memory_parse_skipped","msg":"...memory file bad.md"}   ← no file field
5.5.1  {"event":"memory_parse_skipped","file":"bad.md","reason":"missing frontmatter"}

The event still said a memory file was unparseable, but not which one — which is
the only thing an operator needs from it.

A bare basename is not a disclosure; a path is. Filename fields now pass through
only when the value is bounded, separator-free, and free of parent references, so
/home/someone/.remembra/secret.md, ../../etc/passwd, C:\Users\..., and an
over-long name are all still refused in a file field.

The policy only inspected top-level keys

applyLogFieldPolicy ran once on the caller's field object, so a nested path
walked straight through:

logEvent("warn", "x", { details: { path: "/home/someone/..." } })
5.5.0  {"event":"x","details":{"path":"/home/someone/..."}}   ← leaked
5.5.1  {"event":"x","details":{}}

The redactor was already recursive; the policy was not. It is now applied at
every depth — three levels down, and inside objects held in arrays — with the
top level left alone so an identity is not hashed twice.

Also in this release

The roadmap's renumbering table — added at the 5.5.0 release — was garbled, was
missing the V5.2 and V5.3 slots entirely, and claimed a shift its own table did
not describe. It is corrected, and the compatibility report matches it.
docs/observability.md notes the policy's history so the next reader knows the
rules were tightened after the fact.

Release evidence

Gate	Result
Build	pass
Full suite	688 tests, 0 failures
Security matrix	142 tests, 0 failures
Recovery matrix	52 tests, 0 failures
Python SDK	28 tests, 0 failures
Documentation links	41 files, 0 broken
npm audit --omit=dev	0 vulnerabilities
Node runtimes	18.20.8 and 24.21.0
Registry install	verified from npm and PyPI after publication

Compatibility

No route, environment variable, metric, or default changes. The only difference
from 5.5.0 is which log fields survive. ^5.5.0 consumers pick this up
automatically.