feat: R2 — honest retrieval metadata on every recall

[kevintseng]

R2 — honest retrieval metadata

Every recall now says how it was answered. The silent shape this removes: embeddings configured, sqlite-vec missing or the provider down → recall silently served keyword-only results with nothing in the response saying so; and a limit-full window was indistinguishable from a complete answer.

The retrieval block

Carried on every recall envelope — MCP, HTTP and memesh recall --json alike:

{ "entities": [...], "retrieval": { "mode": "hybrid", "degraded": false, "truncated": false } }

• mode — hybrid when the vector supplement actually ran; fts when the answer is keyword-only (by configuration, or no searchable query).
• degraded — true means embeddings ARE configured but the vector side could not run right now (provider failure or missing sqlite-vec). Keyword-only-by-configuration is NOT degraded — that distinction is the point.
• truncated — true means results filled limit; more may exist. The difference between "that is all" and "that is all I was allowed to return".

Mechanics: supplementWithVectors reports its outcome (used / unconfigured / degraded) instead of returning void with a silent catch; recallEnhanced returns {entities, retrieval} and recallWithConflicts threads it through, so the three transports cannot drift.

Surface changes

• CLI human output: a degraded warning line (pointing at memesh doctor) and a (limit reached — more may exist) note.
• memesh recall --json now always prints the object envelope {entities, retrieval, conflicts?} — previously a bare array normally and an object only when conflicts existed. MCP and HTTP abandoned that bimodal shape in v4.5.x (it broke Gemini CLI); the CLI now matches. Called out in the CHANGELOG. Repo-wide grep found no programmatic consumer of the bare-array shape (docs examples feed LLMs, not parsers).
• AGENTS.md + the memesh skill teach agents to read retrieval instead of guessing — the natural counterpart of the anti-hallucination clauses shipped in docs(agents): what an agent must never invent #180.

Verification (run in this session, verdicts by exit code)

node scripts/run-tests-isolated.mjs   exit=0   Test Files 147 passed (147) / Tests 2159 passed (2159); 0 "Errors" lines
npm run verify:release                exit=0   (lint, typecheck, version-coherence, generated-mirror, doc-claims, verification-audit, audit:prod all green)

Break-test against the committed baseline: mutating the vector-failure catch back to the old silent swallow (return 'used') turns tests/recall-retrieval-meta.test.ts red (1 failed, exit 1); restoring turns it green (6 passed, exit 0).

The first full-suite run itself caught two real gaps, both fixed in the last commit: the one remaining bare-array consumer of recall --json (flag-validation's merge-strategy pin), and dist/skills-manifest.json lagging the SKILL.md edit (the manifest hashes skill files, not only hooks).