feat(plane): memory store (file and MinIO) and the remember task (harnessx-removal task 2)

plane/memory.py: the MemoryStore interface with FileStore (index.jsonl, facts by
content hash, repos/<host>__<owner>__<name>/<pin>.jsonl, idempotent ingest,
deterministic row ids, refusal below 1 GiB free naming the path) and MinioStore
(object metadata and tags, S3 Select pushdown probed once per process with a
logged local fallback, object version ids on every row read, versioning and
runs/ lifecycle helper, presigned URLs). OUSAST_MEMORY selects the backend;
MINIO_* settings come from .env; the minio SDK is the optional extra `minio`.

plane/tasks/remember.py: model-free rows (facts, verdict, unit_cost, alert)
from a case's artifacts; remember_run computes them on the host for a recorded
run without writing into it. reconciler.mark_done (477 lines total), seed
before and ingest after `ousast plane run`, `ousast plane remember <run>`.
The generator annotates each repo-facts Task with openultrasast.io/memory-key
(repo, pin, candidates digest, image digest) and the Run with its population
and split; plane/ regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_plane_reconciler.py

@@ -756,6 +756,22 @@ def test_the_task_is_applied_after_everything_it_binds(tmp_path: Path) -> None:
         assert docs[-1]["kind"] == "Task", [d["kind"] for d in docs]
 
 
+def test_mark_done_sets_the_state_under_the_run_lock(tmp_path: Path) -> None:
+    import os
+
+    base = tmp_path / "r"
+    base.mkdir()
+    (base / "lock").write_text(json.dumps(os.getppid()))  # a live process that is not this one holds the run
+    with pytest.raises(RuntimeError, match="run is held by pid"):
+        reconciler.mark_done("r", "c-facts", reused={"sha256": "ab", "from_run": "r0"}, results_root=tmp_path)
+    assert not (base / "state.json").exists()
+    (base / "lock").unlink()
+    reconciler.mark_done("r", "c-facts", reused={"sha256": "ab", "from_run": "r0"}, results_root=tmp_path)
+    task = json.loads((base / "state.json").read_text())["tasks"]["c-facts"]
+    assert (task["status"], task["reused"]) == ("done", {"sha256": "ab", "from_run": "r0"}) and task["finished"]
+    assert not (base / "lock").exists(), "the lock is released"
+
+
 def test_reconciler_is_under_500_lines_and_holds_no_pipeline_logic() -> None:
     text = RECONCILER.read_text(encoding="utf-8")
     assert len(text.splitlines()) < 500, "Req 3.4: the reconciler stays under 500 lines"