feat(privacy): audited redaction that keeps history's shape and removes its content

Rows in append-only history are never deleted; their content can now be
made irrecoverable through one audited path. A redaction replaces the
content columns of an event, memory, message, model call, belief or
assertion with a fixed marker, keeps identifiers, links, timestamps,
scores and breakdowns, writes an append-only ledger row with a SHA-256 of
the removed content, appends a redaction event, optionally cascades to
derived rows and to the events that quote them, and scrubs stored snapshot
archives before re-signing them. noema_redact() is the only write the
append-only trigger admits, for UPDATE only, under a transaction-local flag
the application never sets; plain updates and all deletes stay refused.
Replay labels redacted stimuli instead of inventing them.

Cryptographic erasure was considered and deferred with reasons (ADR-0009);
docs/privacy.md defines retained, redacted, irrecoverable and deleted and
states what backups and earlier exports are not covered. Migration 0023.

pkg/events/events.go

@@ -64,6 +64,7 @@ const (
 	ModeChanged            Type = "mode_changed"
 	ResponseGenerated      Type = "response_generated"
 	CycleCompleted         Type = "cycle_completed"
+	Redaction              Type = "redaction" // content of an earlier row was made irrecoverable under a policy
 )
 
 // Category groups types for filtering and colouring in the UI.
@@ -88,7 +89,7 @@ var categories = map[Type]Category{
 	Observation: CatPerception, Perception: CatPerception,
 	ThoughtCandidate: CatCognition, ThoughtSelected: CatCognition, WorkspaceBroadcast: CatCognition, AttentionShift: CatCognition,
 	Reflection: CatCognition, ContradictionDetected: CatCognition, Metacognition: CatCognition, DreamAssociation: CatCognition,
-	NarrativeUpdated: CatCognition, ResponseGenerated: CatCognition, CycleCompleted: CatSystem, ModeChanged: CatSystem,
+	NarrativeUpdated: CatCognition, ResponseGenerated: CatCognition, CycleCompleted: CatSystem, ModeChanged: CatSystem, Redaction: CatSystem,
 	MemoryCreated: CatMemory, MemoryRetrieved: CatMemory, MemoryReinforced: CatMemory, MemoryDecayed: CatMemory, MemoryConsolidated: CatMemory,
 	BeliefCreated: CatBelief, BeliefUpdated: CatBelief, BeliefChallenged: CatBelief, BeliefRetracted: CatBelief,
 	HypothesisCreated: CatBelief, HypothesisSupported: CatBelief, HypothesisWeakened: CatBelief,
@@ -160,6 +161,7 @@ type Event struct {
 	Summary       string          `json:"summary"`
 	Metadata      map[string]any  `json:"metadata"`
 	Payload       json.RawMessage `json:"payload"`
+	RedactedAt    *time.Time      `json:"redacted_at,omitempty"` // content replaced by a marker; see redactions
 }
 
 // New describes an event to append. Zero OccurredAt means now.