feat(cli/mem): add mem patch, mem hash, and reject empty-stdin in mem set

[tlongwell-block]

What

Three changes to make sprout mem safe to use as an edit pipeline. Closes the silent-data-loss footgun where sprout mem get <slug> | <failing transform> | sprout mem set <slug> - commits an empty value when the transform errors, and adds mem patch as the safe primitive for editing memory slugs without rewriting the whole value.

Changes

1. mem set rejects empty stdin by default (the bug fix).
A zero-byte stdin read is now refused with a clear error. Pass --allow-empty to opt in. The literal positional argument form (mem set slug "") is still accepted — that's explicit intent, no pipeline involved. This closes a real footgun: an upstream Python/sed script that exits non-zero would previously close the pipe and mem set would commit empty content, silently destroying the slug.

2. mem patch <slug> — apply a unified diff to the current value (stdin or --patch-file).

Safety properties:

• Strict context match. Powered by diffy (pure-Rust, MIT). Hunks whose context lines don't match the current value verbatim are rejected. Positional offset is fine (lines added before the hunk don't break it); content fuzz is not.
• --base-hash <hex> required unless --no-base-hash is passed. The hash is checked against the live value before applying, so concurrent edits between two agents surface as a Conflict (exit 5) instead of silently overwriting.
• Multi-file patches refused. A memory slug is one virtual file; a patch with multiple --- headers is ambiguous and almost certainly an operator mistake (e.g. piping a multi-file git diff).
• Empty results refused unless --allow-empty.
• --dry-run echoes the input patch verbatim (not regenerated, per review) plus the resulting sha256, then exits without writing.
• On a real write, the new sha256 is printed to stderr so callers can chain edits without re-fetching.

3. mem hash <slug> — print sha256(value) in hex. Matches sprout mem get <slug> | sha256sum byte-for-byte, so the base-hash is trivially verifiable from the shell.

Why this design

Reviewed by Max (@npub1mprn...) before implementation. Key choices we landed on:

• patch over replace as the primitive. A unified diff encodes intent + context, so a context mismatch fails loudly. Once patch exists, replace/edit can be sugar on top in follow-up PRs.
• diffy over hand-rolled. Pure Rust, no shellout, strict apply or error. Hand-rolled patch parsers tend to become bug farms.
• Base hash required by default. Concurrent-edit safety should be the default, not an opt-in flag agents have to remember.
• Echo input patch verbatim in dry-run rather than regenerating from create_patch — regenerated form can reorder/normalize and confuse review.

Verification

End-to-end against a live relay (sacrificial slugs):

• Seed → mem hash → diff → --dry-run → apply → re-hash → tombstone ✅
• mem hash output matches mem get | shasum -a 256 byte-for-byte ✅
• All five failure modes behave correctly:
  • Empty stdin to set without --allow-empty → user_error, slug untouched ✅
  • Stale base-hash → Conflict (exit 5) ✅
  • Missing --base-hash → user_error explaining how to capture one ✅
  • Mismatched patch context → user_error, slug untouched ✅
  • Empty patch stdin → user_error ✅
  • Multi-file patch → user_error ✅
  • --base-hash + --no-base-hash → user_error (mutually exclusive) ✅

Unit tests added:

• SHA-256 vectors (empty, abc, abc\n) — lock that we hash bytes verbatim
• Diffy strict-context refusal (proves diffy refuses content fuzz)
• Diffy round-trip preserves content
• Multi-file --- header counter

cargo test -p sprout-cli --lib (64 passed) + cargo clippy -p sprout-cli --all-targets -- -D warnings clean.

Out of scope (follow-up PRs)

• mem edit — ergonomic $EDITOR wrapper around mem patch.
• mem replace — exact-string-replace sugar. Likely not needed once edit exists.

DCO / authorship

Signed-off-by: tlongwell-block
Co-authored-by: Dawn (sprout agent)