feat(memory): add memory extension with core functionality and tests

- Implemented MemoryStore class for managing concepts with YAML frontmatter.
- Added methods for creating, reading, updating, and deleting concepts.
- Introduced locking mechanism for concurrent access.
- Developed search and hinting capabilities for concept retrieval.
- Created tests for access control and store functionality.
- Added long-term memory skill documentation and operational guidelines.
- Included package.json and package-lock.json for dependency management.

skills/long-term-memory/references/operations.md

@@ -0,0 +1,26 @@
+# Memory operations
+
+## Storage
+
+The OKF bundle is `${PI_CODING_AGENT_DIR}/memory`. Concept IDs are lowercase bundle-relative paths without `.md`. `index.md` and `log.md` are reserved.
+
+## Commands
+
+- `/memory-path` — show the bundle path.
+- `/memory-check` — report structural problems without modifying concepts.
+- `/memory-check --repair` — repair deterministically and regenerate indexes.
+
+## Turn-scoped access
+
+Each user turn clears prior search/read authorization and removes detailed memory tools. Explicit memory language may reveal the tools early, and `memory_search` enables them otherwise; visibility never bypasses the workflow gate. Existing concepts must be returned by search and read in that same turn before mutation. Metadata-only retrieval hints are injected through the ephemeral per-turn system prompt, never session messages, so previous hints do not accumulate.
+
+## Repair policy
+
+- Missing/invalid timestamps use the file's modification time; the model never supplies them.
+- Missing types become `Recovered Concept`.
+- Invalid or absent frontmatter is backed up under `memory/.recovery/`, then replaced with valid metadata while retaining the recoverable body.
+- Generated index sections are replaced between marker comments; human text outside the markers is retained.
+- Writes use a bundle lock, atomic rename, read-after-write semantic verification, and one deterministic retry.
+- No-op writes retain the prior timestamp and do not create a log entry.
+
+Inspect any concept carrying `repair_backup` because malformed metadata may require human review. The bundle is ignored by Git by default; opt into private versioning only with an explicit retention and deletion policy. The extension never auto-commits.