feat: 段页式记忆流转、coldcontext 重命名与安全治理

记忆层：
- MemoryBlock 承载 FrameTS/PageSeq/PageKind/BlockRole/CallID
- coldcontext 归档与回填按完整页传递，工具调用参数和配对键不丢失
- 召回先估算总 token，超预算时按全局页相似度标记 inactive
- inactive 仅是 context 渲染期状态，不落盘、不进入 coldcontext，Prune 后重置
- Peek/确认/Remove 两阶段召回，失败保留冷上下文副本
- stablemem 记录 last_recalled_at，删块连带清理边

命名：
- internal/memory/document → internal/memory/coldcontext
- Doc/DocEvent/DocHit → ColdDoc/ColdEvent/ColdHit
- ContextToColdContext/RecentColdContexts/FindColdContexts
- 保留既有 JSON 标签、doc_ 文件前缀与 doc_count 状态键，兼容存量数据

安全治理：
- 工具策略门禁、安全配置、事件总线发布者身份与入站脱敏
- 声明式 SecurityAPI 与 QQ owner/guest profile
- 日志保留策略与相关 e2e/回归判据

验证：go build ./...、go vet ./...、go test ./...（62 包）；
生产副本 e2e：7013 块迁移后 ID/向量/指纹 0 变化、0 缺失。

internal/agent/core/status.go

@@ -9,7 +9,7 @@ import (
 
 	agentIO "github.com/JianFeeeee/HologramAgent/internal/agent/io"
 	"github.com/JianFeeeee/HologramAgent/internal/memory"
-	"github.com/JianFeeeee/HologramAgent/internal/memory/document"
+	"github.com/JianFeeeee/HologramAgent/internal/memory/coldcontext"
 	"github.com/JianFeeeee/HologramAgent/internal/memory/social"
 	"github.com/JianFeeeee/HologramAgent/internal/memory/text"
 	"github.com/JianFeeeee/HologramAgent/internal/meta"
@@ -87,7 +87,7 @@ func collectKernelStatus(
 	pluginReg *plugin.Registry,
 	memDB *memory.GraphDB,
 	ks interface{ List() []string },
-	docStore *document.Store,
+	coldcontextStore *coldcontext.Store,
 	textMem *text.Memory,
 	socialStore *social.SocialStore,
 	trk *tracker.Tracker,
@@ -198,9 +198,9 @@ func collectKernelStatus(
 	}
 
 	// Documents
-	if docStore != nil {
+	if coldcontextStore != nil {
 		status.Documents.Available = true
-		stats := docStore.Stats()
+		stats := coldcontextStore.Stats()
 		if dc, ok := stats["doc_count"].(int); ok {
 			status.Documents.DocCount = dc
 		}
@@ -281,7 +281,7 @@ func (a *Agent) GetKernelStatus() *KernelStatus {
 		a.pluginReg,
 		a.memory,
 		knowledgeLister,
-		a.docStore,
+		a.coldcontextStore,
 		textMem,
 		socialStore,
 		trk,