feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

tools/tht/internal/workspaceops/operations_test.go

@@ -20,6 +20,23 @@ type fakeRunner struct {
 	stdins []string
 }
 
+func TestEvidenceConsolidationUsesClosedMaintenanceContract(t *testing.T) {
+	request, err := Parse([]string{"evidence", "consolidate", "--workspace", "sales", "--json"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if request.operatorCommand() != "evidence-consolidate" || !request.JSONMode() {
+		t.Fatal("incorrect command")
+	}
+	envelope, err := request.stdinEnvelope()
+	if err != nil || envelope.WorkspaceID != "sales" {
+		t.Fatal("incorrect workspace envelope")
+	}
+	if _, err := Parse([]string{"evidence", "consolidate", "--workspace", "../foreign"}); err == nil {
+		t.Fatal("accepted an unsafe workspace")
+	}
+}
+
 func (r *fakeRunner) Run(_ context.Context, args []string, stdin io.Reader) (compose.Result, error) {
 	payload := ""
 	if stdin != nil {
@@ -147,3 +164,29 @@ func contains(values []string, sequence ...string) bool {
 func successResult(operation string) string {
 	return `{"schemaVersion":1,"status":"succeeded","code":"ok","workspaceId":"abc","workspaceRevision":"1234567890abcdef1234567890abcdef12345678","descriptorBlob":"sha256:` + strings.Repeat("f", 64) + `","operation":"` + operation + `","completedStages":[]}`
 }
+
+func TestEvidenceSourceCommandsAreClosedAndCarryReviewIdentity(t *testing.T) {
+	request, err := Parse([]string{"evidence", "refresh", "--workspace", "sales", "--json"})
+	if err != nil || request.operatorCommand() != "evidence-refresh" {
+		t.Fatalf("refresh: %v", err)
+	}
+	args := []string{"evidence", "decide", "--workspace", "sales", "--source-id", strings.Repeat("a", 64), "--revision", strings.Repeat("b", 64), "--decision", "keep"}
+	request, err = Parse(args)
+	if err != nil {
+		t.Fatal(err)
+	}
+	envelope, _ := request.stdinEnvelope()
+	if envelope.SourceID != strings.Repeat("a", 64) || envelope.Decision != "keep" || request.operatorCommand() != "evidence-decide" {
+		t.Fatal("review identity lost")
+	}
+	for _, invalid := range [][]string{
+		{"evidence", "refresh", "--workspace", "sales", "--url", "http://localhost"},
+		{"evidence", "decide", "--workspace", "sales"},
+		append(append([]string{}, args...), "--decision", "replace"),
+		{"evidence", "consolidate", "--workspace", "sales", "--source-id", strings.Repeat("a", 64)},
+	} {
+		if _, err := Parse(invalid); err == nil {
+			t.Fatalf("accepted invalid flags: %v", invalid)
+		}
+	}
+}