feat(memory): say when a turn used stored memory, and which

[sulthannauval]

Problem

Recalled memory was prepended to every prompt with nothing on any surface
saying so. An answer shaped by a remembered fact read as if the model simply
knew it, and an operator had no way to tell the difference — or to find the
entry responsible. This was raised as the one gap left open by the memory
UI/UX sweep (#414, #415, claw-ui #50).

Change

• build_memory_context returns MemoryContext { block, keys }. The keys are
  carried rather than parsed back out of the block: the block's shape is a
  prompt-formatting decision, and a reader deriving keys from it would break
  the next time that shape changed.
• The agent emits AgentEvent::MemoryRecalled { keys } before the first chunk,
  and only when something was injected — an empty recall stays silent.
• TUI renders ↺ recalled N memories: ….
• Gateway forwards it as memory_recalled on the chat stream (consumed by
  claw-ui, separate PR).
• Channels take .block only: a remote transport has no event stream to
  surface it on.

Auto-saved turns are counted, not named. Their keys are user_msg_<uuid>,
and the first version of this line filled the terminal width with hex while
saying less than "3 from this conversation" does — the same defect the console's
memory panel had with generated keys.

Validation

• cargo test --lib memory:: / tui::app / agent:: / gateway::api_v1 and
  --test agent_e2e — 629 passed across the affected areas.
• Mutation-tested both directions: removing the emit fails the test, and
  emitting unconditionally fails its control.
• Strict delta gate — clean.
• Driven live in the TUI against a real store, with a stub provider so the turn
  completes:

You: when is the deployment window?
System: ↺ recalled 5 memories: 5 from this conversation
Assistant: Deployments happen Friday afternoons only.

Two things this surfaced

The first version rendered nowhere. It pushed to scrollback_queue, which
— along with commit_message_to_scrollback — nothing in src/ reads any more.
Only driving the binary caught it. Both are left in place rather than removed
here: dead code is worth a separate, deliberate change.

What actually gets injected is conversation echo. In the run above, all
five recalled entries were auto-saved turns; the curated deploy_window fact
never reached the prompt, although a direct memory recall ranks it at 100%.
recall_layered puts conversation-scoped hits first and they fill the entry
budget. That is pre-existing behaviour and changing it changes what every turn
sends to the model, so it is not touched here — but it is worth deciding on,
and it was invisible until this landed.

Risk / rollback

Medium: one new event variant, one changed return type with three call sites.
No config or schema change. Revert the commits.

[github-actions]

PR intake checks found warnings (non-blocking)

Fast safe checks found advisory issues. CI lint/test/build gates still enforce merge quality.

• Missing required PR template sections: ## Summary, ## Validation Evidence (required), ## Security Impact (required), ## Privacy and Data Hygiene (required), ## Rollback Plan (required)
• Incomplete required PR template fields: summary problem, summary why it matters, summary what changed, validation commands, security risk/mitigation, privacy status, rollback plan

Action items:

1. Complete required PR template sections/fields.
2. Remove tabs, trailing whitespace, and merge conflict markers from added lines.
3. Re-run local checks before pushing:
   • ./scripts/ci/rust_quality_gate.sh
   • ./scripts/ci/rust_strict_delta_gate.sh
   • ./scripts/ci/docs_quality_gate.sh

Run logs: https://github.com/RantAI-dev/RantAIClaw/actions/runs/31082831161

Detected blocking line issues (sample):

• none

Detected advisory line issues (sample):

• none