Harden field memory writes for 3.9.11

[suboss87]

Summary

• Route session-stop/pre-compact memory writes through the locked CLI (capture / preserve), with PATH fde discovery matching session-start.
• Redact private .signal-ledger content in prep/dashboard; apply secret detection to next: debrief lines; write fieldbooks atomically.
• Keep locks conservative (no age-based reclaim); add focused regressions including PATH fallback and a v3.9.10-shaped upgrade fixture.
• Cut patch release metadata to 3.9.11.

Test plan

• npm run check (60 tests + structural gate)
• Hook bash syntax (bash -n on session hooks)
• Confirm CI green on this PR
• After merge: npm publish / plugin marketplace pickup for 3.9.11
• Smoke on a real engagement: session end capture + dashboard refresh

Rollout notes

• Prefer squash merge (intermediate commits briefly tried stale-lock reclaim before reverting).
• No .fde schema migration; 3.9.10 can still read memory written by 3.9.11.
• Abandoned .lock files still require manual removal (by design).

Made with Cursor

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.