feat(mcp): add mempalace_sync_status tool and freshness hook

[rusel95]

🤔 The problem

An AI agent searches the palace and gets results. Are those results current? Were the source files modified since the last mine? There is no way to know — the agent just has to trust that the memories are fresh.

This is a correctness risk. Stale memories can inject outdated or contradictory context into live reasoning.

✅ What this does

MCP tool: mempalace_sync_status

A read-only tool that tells the agent exactly what is fresh, what is stale, and what to do about it:

// All good
{"status": "fresh", "total_source_files": 58, "fresh": 58, "stale": 0}

// Something changed
{
  "status": "stale",
  "fresh": 52, "stale": 6,
  "stale_files": [{"file": "/path/to/README.md", "drawers": 55, "wing": "my-project"}],
  "remine_commands": ["mempalace mine /path --wing my-project --force"],
  "message": "6 files changed since last mine. Run the remine_commands to refresh."
}

// Mined before content_hash support
{"status": "unknown", "message": "All 58 source files lack content_hash. Re-mine with latest version to enable freshness tracking."}

No side effects. The agent can call this before trusting search results, then suggest re-mine commands to the user.

Hook: mempal_freshness_hook.sh

Stop hook that checks freshness once per session (configurable CHECK_INTERVAL, default 3600s). Warns the agent when stale files are detected.

🔒 Security

• SESSION_ID sanitized via tr -cd A-Za-z0-9_- to prevent path traversal in stamp file
• Directory filter enforces path boundary (trailing separator) — /project does not match /project_other
• Uses sed instead of grep -P for macOS compatibility
• $CHECK_DIR quoted to handle paths with spaces

🧪 Tests

8 sync-specific tests + all 103 existing MCP server tests pass.

python -m pytest tests/test_mcp_server.py -q
111 passed

Depends on: #1343 (content_hash in drawer metadata — without it, tool returns status: unknown)
Relates to #224.

[rusel95]

✅ End-to-end testing completed

Ran the full freshness detection pipeline against real ChromaDB: mine files → edit/delete → call tool_sync_status() → verify status.

Tests verified (8 in tests/test_mcp_server.py + 4 e2e):

Scenario	Expected	Result
Mine 3 files, no changes	status: fresh, stale: 0	✅
Mine → edit README.md	status: stale, stale_files has README, remine_commands present	✅
Mine → delete notes.txt	missing >= 1	✅
Filter to /nonexistent/	total_source_files: 0	✅
Empty palace	status: empty	✅
No palace	Error response	✅
Legacy drawers (no hash)	status: unknown (honest, not false-fresh)	✅
Directory filter scoping	Only files under filtered path checked	✅

python -m pytest tests/test_mcp_server.py -k sync -v
8 passed in 18s

Full suite (including readme claims test for tool count 29→30): 0 regressions.