refactor(core): lift the redaction flag policy out of update_memory_detailed #1520

Problem

update_memory_detailed (~200 lines) mixes validation, masking of three inputs, merging redaction counts, a five-arm match that decides which redacted / redactions flags survive each kind of edit, and the re-embed and write. The match is correct (it is covered by tests) but it is a policy table written inline, and it leans on the magic string [REDACTED:.

Direction

Give the flag policy its own module that can be tested without a store, and let update shrink to validate, mask, write.

Behaviour impact

None. The policy table must be preserved exactly (existing tests in privacy_write_tests.rs are the guard).

Acceptance

• The policy is a pure function with its own tests (no SQLite).
• update_memory_detailed loses the inline match.

Part of the round-2 deepening epic.