feat: gateway trace-sink adapter (MCP call traces)

[rz1989s]

What

armory-memory becomes the first live gateway trace sink (SPEC-1b-3 D2): when @getpipher/armory-gateway is installed in the same pi, the extension registers a registerTraceSink via guarded dynamic import and persists every executed MCP call as one metadata-only JSONL line at ~/.pi/agent/memory/<cwd-slug>/mcp-traces.jsonl.

• Line shape: {ts, server, tool, ok, durationMs, resultSummary, agent?, task?} — args are never serialized (structural exclusion, byte-level test pin); resultSummary is content-free at the tap.
• Sits OUTSIDE the *.md injection surface (listMemory/renderMemoryBlock never see it); cap 500 entries, compact >1000, torn lines dropped at compact.
• Registration in a new session_start handler (guarded import; absent gateway → silent skip, standalone memory unchanged).
• Contract tests resolve the real private module via ARMORY_GATEWAY_PATH + runtime symlink helper (no package.json coupling — public clone && npm install && npm test stays green; tests skip-with-notice when unset).
• Release gate strictly clones the private sibling (per-repo SIBLINGS_PAT) and installs gateway's deps before npm test.

Commits

266d089 pure sink · c1f8f57 adapter+contract tests+wiring+README · 3949d1d CI gate · 094074f docs relocation · e21fcfd CI fix (below)

V3 dry-run evidence (found + fixed a real gap)

• Run 33829481297 ❌ → bare CI clone has no gateway node_modules; the contract import threw at module load.
• Fix e21fcfd: install gateway deps inside the cloned sibling before npm test.
• Re-run 33829736747 ✅ — clone via SIBLINGS_PAT green, real-module contract tests executed: pass 3 / fail 0 / skipped 0, publish skipped (version guard, as designed).

Local evidence

RED→GREEN per task; npm test four stages green; final whole-branch review (session model): Yes — 0 Critical/Important; deferred minors triaged (recorded in .superpowers/sdd/progress.md).

Docs

docs/SPEC-1b-3-gateway-trace-sink.md — relocated spec sections + as-built notes.