personal memory agent

build(ci): guard the brain health cutover master

Add a source guard for the active-brain health cutover, wire it into install checks, tighten the tools HTTP-only allowlist, and update backup excludes for brain state artifacts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>