feat: release MemoryMaster 4.5 governed core

[wolverin0]

Summary

• ships the complete governed-core remediation roadmap through Phase 4
• keeps SQLite as the personal/local production default; Qdrant remains optional and Postgres/team mode remains deferred
• hardens retrieval, lifecycle, capture budgets, evidence provenance, supply-chain contracts, and release verification
• publishes the audited 4.5.0 release candidate from a clean two-commit integration branch

Provenance

The final tree is byte-for-byte identical to remediation commit d73b657. The first commit is a clean squash of the audited implementation; the second binds the exact synthetic test-fixture fingerprint to that commit. No history was rewritten.

Local verification

• clean focused release matrix: 84 passed
• supply-chain contracts: 70 passed
• project Ruff: passed
• generated release truth: passed
• wheel + sdist build and Twine validation: passed
• clean minimal-CLI and MCP-extra wheel smokes: passed
• Gitleaks full history: 802 commits, zero unreviewed findings
• isolated OSV dependency audit: 36 dependencies, zero known vulnerabilities

The monolithic local non-ML run exceeded the 15-minute budget without a captured failure; this PR's GitHub matrix is the authoritative full-suite gate.