Address pre-publish review findings for corbits-memory

[TheGreatAxios]

Addresses CL-8195 pre-publish review findings.

Summary:

• README install is now npm install @corbits/memory (published path; no git URL, no unpublished note).
• README documents the feed, forget, purge, and set-retention-class routes with their grants, and points at the @corbits/memory/distiller and @corbits/memory/config exports.
• README declares the Bun-only runtime backed by the engines field (no dist build).
• @types/bun pinned from latest to exact 1.4.2 (lock updated to match).
• package.json author is Sawyer Cutler <sawyer@dirtroad.dev>.

Verification:

• bun run typecheck (tsc --noEmit): pass, exit 0.
• bun test ./src: 481 pass, 0 fail, exit 0.
• npm pack --dry-run: 80 files, 136.1 kB tarball, exit 0.

Fixes CL-8195

[TheGreatAxios]

Review

Verdict: request changes. No prior reviews. CI test is green on 2026-09-17, which is stale vs current main. GitHub reports CONFLICTING.

This branch is still a pre-publish README/package.json pass against old main. Three later commits (#41 FKs, #43 sidecar, #44 team-memory) are not in it.

Blocking

• README now tells people to npm-install @corbits/memory. The package is unpublished (npm view 404). That install path fails until a real publish. Keep the unpublished/git note or land this with the publish.
• README rebase: current main documents sidecar / workflow-memory APIs. This branch still describes defineTool factories. A naive conflict resolve will clobber the sidecar docs.

Not blocking: @types/bun pin latest to 1.4.2; author line is already on main.

Rebase onto current main, restore sidecar install docs, and only claim npm install if the package is actually on the registry. Conflicts with #42 on README Requirements — land #42 first if both stay open.

[TheGreatAxios]

Re-review

Verdict: approve. Rebased at 27e1e8c. MERGEABLE.

Sidecar README survived. Install is still git (package unpublished). No npm install 404. typecheck 0, bun test 484 pass.