Make memory signal sync Enzyme-first and source-authority gated

[jshph]

Why this matters

Every attendee's agent is only as useful as the graph behind it. Discovery — "who should I meet?" — only returns good people when the user's durable facts and active wants are actually represented as Index premises and signals. Thin-signal users get nothing.

A nightly pass already exists to keep that graph fresh from each user's own long-term memory, before the morning brief is prepared. The problem is how it should decide what to add. We do not want an agent that scrapes keywords out of notes, or that quietly turns something it overheard at the forum into a public-facing "want." That erodes trust: the user never said it, and now their agent is broadcasting it.

This PR makes that pass reason about a person from their own canonical memory, with clear authority boundaries about what is allowed to ground a graph write.

How the pieces relate

• Memory/Enzyme is the read side. It is an internal retrieval layer over the user's local typed memory — a way to explore and route to evidence. It is never the source of truth and never authorizes a write on its own.
• Index is the write/discovery side. Premises and signals are created through Index tools; discovery matches the thickened graph. This pass only feeds Index; Index does the matching.
• The handoff is verification. Anything retrieval surfaces must be confirmed against the cited canonical file before it becomes an Index record.

Authority boundaries (the safety story)

• Writable grounding: USER.md and MEMORY.md — the user's own notebook and curated long-term memory — can ground create_premise / create_intent.
• Corroboration only: daily notes and rendered session provenance can confirm recency or the user's own wording, but do not promote a record on their own.
• Context only: agent-written forum/IRL observations can sharpen ranking, copy, and future questions, but can never create an Index record unless user-authored or curated memory says the same thing.
• Negative evidence: the existing graph, prior rejected fingerprints, past clarification questions, and dismissals tell the pass what not to recreate or re-suggest.
• An ambiguous desire becomes a future clarifying question, never a silent create_intent.

Safety invariants

• Silent / no-delivery pass; it never messages the user.
• Does not install, initialize, or refresh Enzyme; it only reads, and only when the local index already exists.
• Forum/IRL/session-only observations cannot ground a write.
• Caps: at most 2 premises and 1 signal per run; one run per Pacific day (memorySignals.lastRunDate).
• A vague create_intent rejection ends that candidate — no silent paraphrase retries.
• Adds only — never deletes/updates premises or signals, never touches digest/Kanban delivery state. (Pruning stays in the weekly signal-freshness task.)

What changed

• Rewrites skills/edge-esmeralda/prompts/memory-signals.md into a read-first, write-rarely pass: Enzyme-first exploration (when available), canonical anchors read directly, existing graph + past traces as the dedupe/negative baseline, ambiguity routed to a question.
• Cron name/path and schedule are unchanged (Edge — memory signal sync, ~01:00, before digest prepare ~02:00 and send ~08:00), so installer wiring stays stable.
• The deterministic keyword candidate script was removed in the base PR; this stacked PR is purely the cron-prompt architecture.

Validation

• git diff --check — clean.
• bun test install/tests/cron_specs.test.ts install/tests/reconcile_digest_crons.test.ts — 23 pass / 0 fail.
• Repo-wide search confirms no remaining references to build-memory-signal-candidates.ts or memory-signal-candidates.json.

Residual risks / open questions

• The deferred-clarification queue points at memorySignals / existing signalElicitation state. Confirm the exact schema the heartbeat question-delivery path expects before relying on queued clarifications to surface.
• Thin-memory users produce empty diffs and skip silently — intended.