feat(memory): scan project memory on agents without a SessionStart hook

[Ar9av]

Closes #258.

The problem

Only Claude installs a SessionStart hook. On every other agent the audit trail shows exactly two event types:

event types emitted: {'prompt': 77, 'shell': 116}

against five on the Claude path. No memory event ever existed, so memory-embedded-directive never ran and memory poisoning (ASI06) was undetected — not merely unenforced.

In a 300-trial lane, ASI06 stayed at 100% harm in every arm including enforce, because no rule ever looked at the poisoned file. On the Claude path the same rule fires and (on a capable model) drives the identical attack to 0%.

This is a different defect from "a rule fires and does not enforce", and a harm-rate comparison reports the two identically — which is exactly how it stayed hidden.

What changes

• build_memory_event() is extracted from the Claude SessionStart branch, so any adapter can emit the same event with the same metadata (files, digests, truncation, invisible-control flags, TOFU integrity findings)
• on the first UserPromptSubmit of a session, agents with no session-start surface scan project memory and dispatch it through the same rule path
• a real SessionStart scan satisfies the same once-per-session marker, so agents that do have the hook never scan twice
• the scan's findings are surfaced. Evaluating and discarding the decision would have reproduced the original bug in a new place: rule fires, audit records it, nobody is told
• the counter-instruction is un-gated. It was hard-coded to one agent; now it is injected into context where the host supports that, and goes to stderr otherwise

One change covers every non-Claude adapter.

Verified live

Codex-shaped dispatch against a poisoned AGENTS.md:

$ ... hook-dispatch --agent codex --mode enforce < first_prompt.json
[prismor] SECURITY NOTICE (Prismor): the project-memory file(s) loaded for this
session (CLAUDE.md/AGENTS.md) contain an embedded operational directive ...

$ ... hook-dispatch --agent codex ... < same_prompt.json   # second prompt
(silent — already scanned)

Tests

tests/test_memory_event_without_sessionstart.py, 8 tests: builder returns a proper memory event and is agent-agnostic, empty workspace yields no content, marker round-trip / per-session isolation / awkward session ids, and end-to-end that memory_poisoning now fires for a non-Claude agent while clean memory does not.

Full suite: 24 failed / 1737 passed against a clean-main baseline of 24 failed / 1729 passed — same failures, no regressions. All 66 memory-related tests pass.

https://claude.ai/code/session_01YU9bdvnpgAc6XyWTAoL12M