fix(memory): enforce transcript trust, scope, and source isolation

[time-attack]

Transcript syncing ignored the off switch and repository trust boundaries, so private sessions from unrelated or blocked projects could be imported into the wrong shared knowledge source.

Transcript syncing now stops when disabled, accepts only the current repository while honoring blocked and read-only policies, and imports sessions into a separate repository-specific transcript source.

Changes

• honor transcript_ingest_mode=off
• limit transcript ingestion to the current repository
• exclude repositories marked deny or read-only
• separate transcript and artifact import batches
• route transcripts through a stable, gbrain-valid dedicated source ID
• add regression coverage for trust, scope, off mode, and source isolation

Verification

The identical issue-specific probe ran against isolated origin/main baseline and candidate environments:

Repository	Baseline	Candidate
actionbook/actionbook	fail	pass
ahtavarasmus/lightfriend	fail	pass
garrytan/gbrain	fail	pass
makeplane/plane	fail	pass
twentyhq/twenty	fail	pass

Targeted tests: 70 passed, 0 failed.

Out of scope

Transcript mining behavior tracked separately in #2144 was not changed.

Fixes #2140

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here