Dream: deterministic privacy boundary for private-session content entering shared agent memory

[Poytr1]

Context

Follow-up to #488 (task #36). PR #488 removed the capture-visibility pre-filter so a dream mines every session the owning agent participated in (channel, DM, webchat, external/GitHub, A2A, launched). Privacy is currently handled by the dream policy prompt (never record a specific person's private/personal conversation content in agentMemory or organizationKnowledge).

Problem (review-bot finding on #488, owner-accepted as P2 for now)

agentMemory is agent-scoped and shared across all users of the agent: any non-excluded session receives the memory index at start and can readMemory. So a private one-to-one exchange (e.g. user A's DM) distilled into agentMemory can later surface to a different user B in a channel session. dreaming.autoAdopt can install such a proposal without human review. agentId-scoped sourcing preserves peer-agent isolation but not the original user audience.

A prompt instruction is not an authorization boundary. We accepted this as a P2 to unblock dream usefulness for DM/external-centric agents, but it needs a deterministic fix.

Proposed options

1. Deterministic autoAdopt gate (recommended, smaller): keep mining all participated sessions, but if a dream's proposal is grounded in a private / narrower-audience session (classify via store.isCaptureExcluded, used to classify not to filter sourcing), block autoAdopt and force human review. Private content then reaches shared memory only through an explicit human decision.
2. Audience-scoped memory (larger): memory entries carry an audience/visibility scope; private-session-derived entries are scoped to the original audience and not surfaced to others.

Acceptance

• A private-session-grounded dream proposal cannot be auto-installed into shared agent memory without human review (option 1), or private-derived memory is not readable outside its original audience (option 2).
• Dreams still mine all participated sessions (do not regress feat(dream): mine every session the agent participated in #488).
• Tests cover the private-session → no-autoAdopt (or scoped-read) path.

Refs: #488, docs/designs/session-visibility.md §5.1 dream-path carve-out, docs/designs/memory-dreaming.md.