Protect Persistent Mind identity and clarify workspace controls

[atomantic]

Summary

Persistent Mind now exposes Settings and Tools & permissions in the header, removes duplicate conversation chrome, and explains workspace diagnostics without implying that every warning blocks CoS delegation. Environment details show detected and required versions, offer an explicit recheck, and can draft an editable repair request. Native repositories no longer receive irrelevant Node dependency warnings.

Memories can be marked Standard, Important, or Core identity. Protected memories receive priority in bounded context and survive manual cleanup, self-cleanup, consolidation, decay, and expiration. The mind can add protection under its existing maintenance grant; removing protection requires an explicit user edit. Existing memories remain standard until protected, using reserved tags in the existing storage format.

Memory candidates are saved before tool execution, retained across provider rounds, deduplicated, and capped at five per turn. A failed or overflowed save prevents cleanup. Ordinary editor saves omit protection so an older browser snapshot cannot undo protection added by the mind.

Test plan

• 167 server tests passed across context, maintenance, tool registry, routes, trajectory, capabilities, workspace preflight, task delegation, visibility, and catalog/import/generated-manifest guards.
• 99 memory service tests and 22 adapter tests passed, including save-before-cleanup and failed-save guards.
• 31 PostgreSQL memory tests passed against portos_test, including protection through consolidation, decay, and expiration.
• 38 targeted client tests passed, including settings, repair/recheck, memory protection, and stale-editor regression coverage.
• Changed-client lint, production build, and git diff --check passed. The build retains the existing large-chunk warning.
• Full-file local review completed; all three findings fixed and verified.