Shared Memory 1.1.3: recovery identity and hold correctness

Fixes five reproduced recovery correctness issues: canonical record versions now retain one content digest; metadata corrections no longer create pending executions; unresolved summaries are bounded; receipts no longer implicitly clear source/episode holds; JSON Pointer escapes are validated.

Originals remain immutable. Old conflicting histories are held without destructive migration or repair. A hold requires an explicit resolving correction and source references; this records a claim, not independent verification or current action authority. Recovery continues to return action_authorized=false. Existing values, public MCP tools, network behavior and permissions are unchanged.

Validation: the five review reproductions failed on 1.1.2; all 49 corrected recovery/reference tests pass, including legacy conflict quarantine, explicit hold resolution, valid escapes and summary limits. Normal package/build/container/stdio CI and reproducible bundle checks passed. No private workspace/key or source-body import was performed.