Make GraphKeeper memory retrieval-first

[anusbutt]

Outcome

Agents now query and assess active GraphKeeper claims before repeating repository investigation. Grounded claims become a starting point with minimum task-specific freshness checks, explicit re-investigation exceptions, and no automatic trust.

Normal validator tests now exercise the canonical Node validator. The jq-based shell validator remains isolated to explicit legacy and parity coverage. Native Windows CI covers the affected no-jq paths.

Evidence

Before implementation, the template integration test failed with GK003 jq 1.6 or newer is required because the shared helper invoked the legacy shell validator.

After implementation:

• Installed TypeScript compiler completed successfully.
• Retrieval guidance contract tests passed: 10/10.
• Agent integration tests passed: 10/10.
• Focused template and validator-mode tests passed without jq: 10/10.
• git diff --check passed.

Checklist

• Tests cover valid, invalid, and relevant security or performance paths.
• Documentation and examples reflect every changed public behavior.
• Schema compatibility is unchanged, additive and documented, or explicitly marked breaking.
• Constitution principles and append-only/evidence guarantees remain satisfied.
• npm run build passes.
• npm run typecheck passes.
• npm test passes with no hidden skips.
• npm run package:smoke passes and the tarball contains intended assets only.
• Legacy shell and hook launchers are unchanged.
• No secrets, credentials, telemetry, generated archives, or unrelated edits are included.

Compatibility and recovery

The canonical Node path is covered on native Windows without jq. Legacy shell compatibility remains available and unchanged for customized repositories. No diagnostics, graph schema, or recovery steps change. Revert commit 9fa10f4 to roll back.