feat: 段页式记忆流转、coldcontext 重命名与安全治理

记忆层：
- MemoryBlock 承载 FrameTS/PageSeq/PageKind/BlockRole/CallID
- coldcontext 归档与回填按完整页传递，工具调用参数和配对键不丢失
- 召回先估算总 token，超预算时按全局页相似度标记 inactive
- inactive 仅是 context 渲染期状态，不落盘、不进入 coldcontext，Prune 后重置
- Peek/确认/Remove 两阶段召回，失败保留冷上下文副本
- stablemem 记录 last_recalled_at，删块连带清理边

命名：
- internal/memory/document → internal/memory/coldcontext
- Doc/DocEvent/DocHit → ColdDoc/ColdEvent/ColdHit
- ContextToColdContext/RecentColdContexts/FindColdContexts
- 保留既有 JSON 标签、doc_ 文件前缀与 doc_count 状态键，兼容存量数据

安全治理：
- 工具策略门禁、安全配置、事件总线发布者身份与入站脱敏
- 声明式 SecurityAPI 与 QQ owner/guest profile
- 日志保留策略与相关 e2e/回归判据

验证：go build ./...、go vet ./...、go test ./...（62 包）；
生产副本 e2e：7013 块迁移后 ID/向量/指纹 0 变化、0 缺失。

internal/plugins/integration_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/JianFeeeee/HologramAgent/internal/knowledge"
 	luaVM "github.com/JianFeeeee/HologramAgent/internal/lua"
 	"github.com/JianFeeeee/HologramAgent/internal/memory"
-	doc "github.com/JianFeeeee/HologramAgent/internal/memory/document"
+	coldcontext "github.com/JianFeeeee/HologramAgent/internal/memory/coldcontext"
 	"github.com/JianFeeeee/HologramAgent/internal/plugin"
 	cli "github.com/JianFeeeee/HologramAgent/internal/plugins/cli"
 	"github.com/JianFeeeee/HologramAgent/internal/plugins/webui"
@@ -22,14 +22,14 @@ import (
 )
 
 type testPluginEnv struct {
-	tmpDir    string
-	stageHost *agentCore.StageHost
-	iom       *agentIO.IOManager
-	pluginReg *plugin.Registry
-	memDB     *memory.GraphDB
-	ks        *knowledge.Store
-	docStore  *doc.Store
-	cfgReg    *internalConfig.ConfigRegistry
+	tmpDir           string
+	stageHost        *agentCore.StageHost
+	iom              *agentIO.IOManager
+	pluginReg        *plugin.Registry
+	memDB            *memory.GraphDB
+	ks               *knowledge.Store
+	coldcontextStore *coldcontext.Store
+	cfgReg           *internalConfig.ConfigRegistry
 }
 
 func setupIntegration(t *testing.T) *testPluginEnv {
@@ -107,15 +107,15 @@ func setupIntegrationWithProvider(t *testing.T, pm *agentAPI.ProviderManager) *t
 		t.Fatal(err)
 	}
 
-	docStore := doc.NewStore(filepath.Join(tmpDir, "documents"), memory.TokenizeWords)
-	if err := docStore.Start(); err != nil {
+	coldcontextStore := coldcontext.NewStore(filepath.Join(tmpDir, "documents"), memory.TokenizeWords)
+	if err := coldcontextStore.Start(); err != nil {
 		t.Fatal(err)
 	}
 
 	pluginReg.SetStageHost(stageHost)
 	pluginReg.SetProviderManager(pm)
 	pluginReg.SetKnowledge(ks)
-	pluginReg.SetDocStore(docStore)
+	pluginReg.SetDocStore(coldcontextStore)
 
 	cli.DefaultSocket = filepath.Join(tmpDir, "cli.sock")
 
@@ -154,14 +154,14 @@ func setupIntegrationWithProvider(t *testing.T, pm *agentAPI.ProviderManager) *t
 	}
 
 	return &testPluginEnv{
-		tmpDir:    tmpDir,
-		stageHost: stageHost,
-		iom:       iom,
-		pluginReg: pluginReg,
-		memDB:     memDB,
-		ks:        ks,
-		docStore:  docStore,
-		cfgReg:    cfgReg,
+		tmpDir:           tmpDir,
+		stageHost:        stageHost,
+		iom:              iom,
+		pluginReg:        pluginReg,
+		memDB:            memDB,
+		ks:               ks,
+		coldcontextStore: coldcontextStore,
+		cfgReg:           cfgReg,
 	}
 }
 
@@ -169,7 +169,7 @@ func (e *testPluginEnv) cleanup() {
 	e.pluginReg.StopAll()
 	e.memDB.Close()
 	e.ks.Stop()
-	e.docStore.Stop()
+	e.coldcontextStore.Stop()
 	os.RemoveAll(e.tmpDir)
 }