Full write pipeline: validate request, assign/generate memory ID,
determine provenance and trust level, sanitize external content,
generate embeddings via Model Gateway, store all data atomically
in DuckDB (memory + tags + correlations + embeddings + provenance +
derivation links), invalidate semantic cache, and audit-log the
write via Audit Service (best-effort).
- New db/write.rs: transactional write helper with rollback
- Audit client integration following Secrets Service pattern
- Remove #[allow(dead_code)] from provenance_config and sanitizer
- 15 new tests (7 db/write, 8 service-level)
- All 226 tests pass, clippy clean
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
