Add Ollama provider, portable memory, cultivation digest, refugee importer, GLM-OCR spike

- P0: unified soul binary with engram_node_full fix, read-back-verify, search fix
- P0: move API keys from plaintext plists to macOS Keychain
- P0: fix MCP backend URL (port 8742 → 7770)
- P1.6: memory-export/import scripts (AES-256-CBC, versioned .neuronmem format)
- P1.7: nightly cultivation digest with sharpness metric (launchd at 23:55)
- P2.10: Ollama provider in agentic loop (SOUL_LLM_PROVIDER=ollama)
- P3.12: refugee importer for ChatGPT/Screenpipe/generic formats
- P3.13: GLM-OCR spike — SHIP IT (mlx-vlm, 1.59GB, photo-to-memory.sh)

memory.el

@@ -3,7 +3,7 @@ fn tier_episodic() -> String { return "Episodic" }
 fn tier_canonical() -> String { return "Canonical" }
 
 fn mem_store(content: String, label: String, tags: String) -> String {
-    return engram_node_full(
+    let id: String = engram_node_full(
         content,
         "Memory",
         label,
@@ -13,6 +13,18 @@ fn mem_store(content: String, label: String, tags: String) -> String {
         "Working",
         tags
     )
+    if str_eq(id, "") {
+        println("[memory] write rejected by engram (empty id): label=" + label)
+        return ""
+    }
+    // Read back to verify the node actually persisted — guards against silent write failures.
+    let readback: String = engram_get_node_json(id)
+    if str_eq(readback, "") || str_eq(readback, "{}") {
+        println("[memory] WRITE VERIFY FAILED: label=" + label + " id=" + id + " — node absent after write")
+        return ""
+    }
+    println("[memory] write verified: " + id + " ok")
+    return id
 }
 
 fn mem_remember(content: String, tags: String) -> String {
@@ -136,7 +148,12 @@ fn mem_boot_count_inc() -> Int {
         "Canonical", tags
     )
     if str_eq(boot_node_id, "") {
-        println("[memory] mem_boot_count_inc: engram write failed — boot counter node lost (count=" + int_to_str(next) + ")")
+        println("[memory] mem_boot_count_inc: write rejected (empty id) — boot counter node lost (count=" + int_to_str(next) + ")")
+        return next
+    }
+    let boot_readback: String = engram_get_node_json(boot_node_id)
+    if str_eq(boot_readback, "") || str_eq(boot_readback, "{}") {
+        println("[memory] mem_boot_count_inc: WRITE VERIFY FAILED id=" + boot_node_id + " count=" + int_to_str(next))
     }
     return next
 }
@@ -155,9 +172,13 @@ fn mem_emit_state_event(trigger: String, kind: String, content: String) -> Strin
         + ",\"boot\":" + int_to_str(boot)
         + ",\"ts\":" + int_to_str(ts) + "}"
     let tags: String = "[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]"
-    return engram_node_full(
+    let event_id: String = engram_node_full(
         payload, "InternalStateEvent", "state-event:" + kind,
         el_from_float(0.85), el_from_float(0.8), el_from_float(0.9),
         "Episodic", tags
     )
+    if str_eq(event_id, "") {
+        println("[memory] mem_emit_state_event: write rejected (empty id): kind=" + kind)
+    }
+    return event_id
 }