feat(cognee): add manual memory lookup helper

[JTInventory]

Summary

Firstmate can now run an optional manual Cognee memory lookup before dispatch without making Cognee part of the authority chain. The helper prints untrusted memory hints separately from opened local source paths and warnings, and --append-brief writes only opened source paths or a non-blocking unavailable note into a brief.

Safety Boundaries

• Manual-only command; no dispatch path auto-queries Cognee.
• Missing or failed FM_COGNEE_LOOKUP_CMD exits 0 with memory unavailable, so dispatch can continue without memory context.
• Raw Cognee answers are never appended to briefs as proof.
• No write/admin Cognee capability, config mutation, or Gbrain fallback path is added.

Validation

• bash -n bin/fm-memory-lookup.sh tests/fm-memory-lookup.test.sh
• tests/fm-memory-lookup.test.sh
• set -e; for t in tests/*.test.sh; do "$t"; done
• git diff --check plus no-index whitespace checks for the two new executable files
• shellcheck bin/fm-memory-lookup.sh tests/fm-memory-lookup.test.sh was not run because shellcheck is not installed in this environment
• Manual diff scan completed; ce-code-review was not run because this session's multi-agent tool policy only allows subagent spawning when explicitly requested

Post-Deploy Monitoring & Validation

No additional production monitoring is required because this is an inert manual CLI helper. Validate on first real use by confirming an unavailable backend prints memory unavailable and exits 0, a configured read-only backend keeps memory hint, verified local source path, and warning separate, and any brief attachment contains only opened local source paths plus advisory wording. Treat any raw Cognee answer in a brief, automatic dispatch query, Gbrain invocation, or nonzero unavailable-backend exit as a rollback trigger.

---