fix(auto-extract): generate UUID before INSERT — NOT NULL constraint (v4.12.5)

[FRIDAY-Drakon]

Summary

v4.12.4 unblocked the read side of auto-extract (path-encoding fix), exposing a second silent failure on the write side. Both `pre-compact-hook.mjs` and `session-end-hook.mjs` built INSERT statements that omitted the `uuid` column. The schema declares `uuid TEXT NOT NULL UNIQUE` with no default, so every insert errored out — silently from the user's perspective.

Reproduction (TARS 2026-04-25)

```text
[auto-extract] Read 4 messages from session JSONL (5186 chars)
[auto-extract] Failed to save "Decision: X, fix Y, prefer Z":
NOT NULL constraint failed: memories.uuid
[shieldcortex] Pre-compact complete: 0 memories auto-extracted
```

`shieldcortex status` still showed 0 memories despite the read side working perfectly.

Fix

• New `scripts/lib/save-memory.mjs` — single source of truth for hook-side memory writes. Generates `crypto.randomUUID()` and binds it to the INSERT.
• `pre-compact-hook.mjs` and `session-end-hook.mjs` delegate via thin wrappers, so they can no longer drift apart and produce "one hook works, the other silently fails" bugs.

Tests

5 new in `src/tests/save-auto-extracted-memory.test.ts` against a fresh SQLite DB built from the real `src/database/schema.sql`:

• Inserts a memory row (the v4.12.4 NOT NULL uuid bug repro)
• Generates a unique UUID per insert (no collision on bulk auto-extract)
• Respects the `uuid UNIQUE` constraint over multiple writes
• Accepts `null` project (sessions without a scoped project)
• Persists `tags` as JSON-encoded text

42/42 release-track tests green.

Verification on a fleet host after v4.12.5

```bash
npm install -g shieldcortex@4.12.5
echo '{"session_id":"x","cwd":"/home/$USER/.openclaw/workspace"}' | shieldcortex hook pre-compact
shieldcortex status # Memories > 0, Last activity recent
```

Why it matters

Second silent zero-memory bug in 24 hours. v4.12.4 closed the path side; v4.12.5 closes the write side. Both shipped because the original auto-extract path had no end-to-end test exercising the actual SQLite schema. The new shared `save-memory.mjs` lib gives every hook one tested write path so the next bug in this area can't hide in two places.

🤖 Generated with Claude Code