feat: 段页式记忆流转、coldcontext 重命名与安全治理

记忆层：
- MemoryBlock 承载 FrameTS/PageSeq/PageKind/BlockRole/CallID
- coldcontext 归档与回填按完整页传递，工具调用参数和配对键不丢失
- 召回先估算总 token，超预算时按全局页相似度标记 inactive
- inactive 仅是 context 渲染期状态，不落盘、不进入 coldcontext，Prune 后重置
- Peek/确认/Remove 两阶段召回，失败保留冷上下文副本
- stablemem 记录 last_recalled_at，删块连带清理边

命名：
- internal/memory/document → internal/memory/coldcontext
- Doc/DocEvent/DocHit → ColdDoc/ColdEvent/ColdHit
- ContextToColdContext/RecentColdContexts/FindColdContexts
- 保留既有 JSON 标签、doc_ 文件前缀与 doc_count 状态键，兼容存量数据

安全治理：
- 工具策略门禁、安全配置、事件总线发布者身份与入站脱敏
- 声明式 SecurityAPI 与 QQ owner/guest profile
- 日志保留策略与相关 e2e/回归判据

验证：go build ./...、go vet ./...、go test ./...（62 包）；
生产副本 e2e：7013 块迁移后 ID/向量/指纹 0 变化、0 缺失。

internal/agent/core/agent_functions_test.go

@@ -3,7 +3,7 @@ package core
 import (
 	"testing"
 
-	"github.com/JianFeeeee/HologramAgent/internal/memory/document"
+	"github.com/JianFeeeee/HologramAgent/internal/memory/coldcontext"
 )
 
 func TestEntitySimilarity(t *testing.T) {
@@ -26,13 +26,13 @@ func TestEntitySimilarity(t *testing.T) {
 }
 
 func TestDocToTriples(t *testing.T) {
-	doc := &document.Doc{
+	doc := &coldcontext.ColdDoc{
 		Summary: "用户喜欢编程",
 		Content: "用户提到喜欢Go和Python",
 		Source:  "context",
 	}
 
-	triples := docToTriples(doc, nil)
+	triples := coldDocToTriples(doc, nil)
 
 	foundSummary := false
 	foundSource := false
@@ -54,18 +54,18 @@ func TestDocToTriples(t *testing.T) {
 }
 
 func TestDocToTriplesNil(t *testing.T) {
-	triples := docToTriples(nil, nil)
+	triples := coldDocToTriples(nil, nil)
 	if len(triples) != 0 {
 		t.Errorf("expected empty for nil doc, got %d", len(triples))
 	}
 }
 
 func TestDocToTriplesNoSource(t *testing.T) {
-	doc := &document.Doc{
+	doc := &coldcontext.ColdDoc{
 		Summary: "无来源文档",
 		Content: "content",
 	}
-	triples := docToTriples(doc, nil)
+	triples := coldDocToTriples(doc, nil)
 	for _, tr := range triples {
 		if tr.Relation == "来源" {
 			t.Error("should not have source triple when Source is empty")
@@ -74,13 +74,13 @@ func TestDocToTriplesNoSource(t *testing.T) {
 }
 
 func TestDocToTriplesTypes(t *testing.T) {
-	doc := &document.Doc{
+	doc := &coldcontext.ColdDoc{
 		Summary: "测试三元组类型",
 		Content: "用于验证 SubjectType 和 ObjectType",
 		Source:  "test",
 	}
 
-	triples := docToTriples(doc, nil)
+	triples := coldDocToTriples(doc, nil)
 
 	for _, tr := range triples {
 		if tr.Subject == "文档" {