2.5.0 — Safer init and a recoverable journal

Safer init and a recoverable journal

Version 2.5.0 hardens adoption. The first repository history is created with
no-replace publication, so an interrupted or concurrent init can no longer
leave a partial journal.jsonl. Interrupted transactions are recovered from
their write-ahead log before any later effect, and a torn history append is
repaired only when the retained log proves the exact bytes. When a gate
remains, init ends with one summary line: init: N item(s) confirmed, M gate(s).
The journal format stays at schema 1 (#27, #28, #29).

Fixes

• init refuses a harness memory path inside the adopter and a project-memory
  target outside it, records managed directory symlinks as symlinks, skips
  harness absorption when a whole-run gate remains, and keeps the backup path
  visible when link publication fails (#16, #17, #18, #19, #20).
• A directory at memory/MEMORY.md is reported as an index finding by lint
  and status instead of a traceback (#20).
• probe bounds aggregate stdout and stderr per invocation (#13).
• Directory-durability failures are explicit and recoverable; repair touches
  only WAL-proven torn tails and owned temporaries (#14, #15).
• journal --check rejects one transaction id reused across the repository
  and local histories for different mutations (#21).
• render keeps the primary write error when temporary cleanup also fails (#22).
• Bootstrap refuses database aliases source and source-*, which would
  collide with source records (#23).
• The session-context startup hook works under Bash 3.2 (stock macOS) and
  with mawk or BusyBox awk, which abort on a directory argument.
• Executing validated_memory.cli directly is a usage error; the CLI is
  python3 -P -m validated_memory (#24).

Documentation

Executed implementation plans left the published tree; the memory-reuse
usefulness evidence now lives under evaluations/memory-usefulness/ and the
recall specification under docs/design/.