feat(plane): memory store (file and MinIO) and the remember task (harnessx-removal task 2)

plane/memory.py: the MemoryStore interface with FileStore (index.jsonl, facts by
content hash, repos/<host>__<owner>__<name>/<pin>.jsonl, idempotent ingest,
deterministic row ids, refusal below 1 GiB free naming the path) and MinioStore
(object metadata and tags, S3 Select pushdown probed once per process with a
logged local fallback, object version ids on every row read, versioning and
runs/ lifecycle helper, presigned URLs). OUSAST_MEMORY selects the backend;
MINIO_* settings come from .env; the minio SDK is the optional extra `minio`.

plane/tasks/remember.py: model-free rows (facts, verdict, unit_cost, alert)
from a case's artifacts; remember_run computes them on the host for a recorded
run without writing into it. reconciler.mark_done (477 lines total), seed
before and ingest after `ousast plane run`, `ousast plane remember <run>`.
The generator annotates each repo-facts Task with openultrasast.io/memory-key
(repo, pin, candidates digest, image digest) and the Run with its population
and split; plane/ regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/fixtures/plane-remember/validation-46/lmdeploy-media-url-ssrf-facts/facts.json

@@ -0,0 +1,22 @@
+{
+  "callers": {
+    "lmdeploy/vl/media/connection.py::_load_http_url": []
+  },
+  "counts": {
+    "callers": 0,
+    "candidates": 1,
+    "files": 1,
+    "functions": 4809
+  },
+  "files": {
+    "lmdeploy/vl/media/connection.py": {
+      "functions": [
+        "_is_safe_url",
+        "_load_http_url",
+        "_load_data_url",
+        "_load_file_url",
+        "load_from_url"
+      ]
+    }
+  }
+}

tests/fixtures/plane-remember/validation-46/lmdeploy-media-url-ssrf-facts/summary.json

@@ -0,0 +1,9 @@
+{
+ "calls": 0,
+ "model": null,
+ "status": "done",
+ "units_done": 608,
+ "units_total": 608,
+ "usage": {},
+ "usd": null
+}

tests/fixtures/plane-remember/validation-46/lmdeploy-media-url-ssrf-facts/task.yaml

@@ -0,0 +1,40 @@
+apiVersion: ax.io/v1alpha1
+kind: Workspace
+metadata:
+  name: lmdeploy-media-url-ssrf-vulnerable
+  atespace: default
+spec:
+  git:
+  - name: repo
+    repo: https://example.com/reserved/lmdeploy
+    dir: repo
+    depth: 1
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: validation-46-lmdeploy-media-url-ssrf-facts
+  atespace: default
+spec:
+  command:
+  - repo-facts
+  env:
+  - name: OUSAST_RUN
+    value: validation-46
+  - name: OUSAST_TASK
+    value: lmdeploy-media-url-ssrf-facts
+  - name: OUSAST_GIT_PINS
+    value: '{"lmdeploy-media-url-ssrf-vulnerable/repo": "71648d239c978452720a6d6692fe914efc8a7b94"}'
+  image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1280Mi
+  workspaces:
+  - name: lmdeploy-media-url-ssrf-vulnerable
+    path: /workspace/case
+  - name: lmdeploy-media-url-ssrf-inputs
+    path: /workspace/inputs