feat(application): read exact Memory Bank SDK effects

[pengfei-threemoonslab]

Application comparison now identifies the documented synchronous Google Memory Bank client in the existing cloud-effect reader. It distinguishes seven exact read/write methods and names literal resource strings from direct keywords or inline requests.

Refs #913. This is the selected Memory Bank SDK increment, stacked on #1018. It does not satisfy the complete attest MemoryBank.from_env() wrapper acceptance; custom object state and that case remain open. Baseline, corpus scores, ledgers, goldens and released-build evaluation remain deferred by the owner.

Selection and boundary

Before implementation, a real static attempt using MemoryBankServiceClient().retrieve_memories(...) and generate_memories(...) returned no effects and named the constructor/method as unread. This PR extends the existing Memory Bank family for that blocked input, using the official Google client reference.

• Recognizes only the synchronous google.cloud.aiplatform_v1beta1 root and services.memory_bank_service exports by import identity.
• Reads retrieve_memories, get_memory, list_memories; writes generate_memories, create_memory, update_memory, delete_memory. Other methods retain unknown operation and a limit.
• A named target requires a string literal in parent, name, or update memory.name. Requests and nested memory objects must be inline dictionaries with literal keys. Python's last-key dictionary semantics are retained.
• Conflicting/unpacked arguments, request aliases and derived/dynamic resource values retain target-reading limits. Unknown client configuration still prevents a whole-tool read claim.
• Existing target/credential redaction and constructor, method, namespace and retained-handle checks remain in use. No library code is imported or executed.

Authorship

• A coding agent wrote some or all of this change. Agent: Codex.
• A person read the whole diff before opening this pull request.

Validation

• 56 new tests passed, including real Git/CLI application rows, all seven methods and request forms, exact import paths, mutation/name-alike refusals, raw argument conflicts, alias-derived resource refusals and redaction.
• Related application/reach/distribution selection: 840 passed, 1 skipped.
• Independent final selection: 169 passed, plus 14 adversarial probes.
• Ruff and diff whitespace checks passed.
• Sequential restack retained the Memory Bank patch unchanged (range-diff equality).
• Committed-source verifier/control at a4ea56e5987b: complete, release decision passed.
• Independent six-increment combination review: 383 tests passed, no actionable P1/P2; the SDK merge preserved candidate uncertainty and inherited conditions.
• Final combination at a4ea56e5987bf: 1,546 tests passed, 1 skipped.
• Shared CI exposed the legacy imported-tool clone-is-unread assertion. feat(application): read bounded source-local SDK clones #1018 corrects it with precise positive and method-replacement/handle-escape refusal assertions. The complete affected selection passed 289 tests, and independent test-only review passed all 4 original parameter cases.
• Follow-up restack at e0b7ba9c42fa changes only that compatibility test compared with the tested combination; production source remains identical. Committed-source control is complete / passed; exact-head GitHub CI passed all 14 applicable checks, including six suite shards and aggregate coverage; the release-tag-only check was skipped.

Independent review and fixes

1. Fixed P2s where conflicting request arguments could name a resource and mutable request aliases could supply stale targets. The reader now checks raw call arguments and requires inline request/memory dictionaries.
2. Fixed a remaining path in the same alias P2: an inline request could contain a value read through a mutated alias, including a scalar alias. Named resource values now require string-literal source evidence; unknown/derived values retain a reading limit.
3. Final independent follow-up found no remaining actionable P1/P2. It confirmed argument/alias refusals, exact SDK imports and mutation guards, unseen configuration limits and token-shaped resource redaction. Full wrapper/corpus acceptance remains open.

Ordered merge preparation

This increment was replayed onto main 662236c775b2, after #1018. New head b047511bf126 has exactly the same file content as reviewed head e0b7ba9c42fa (full-tree diff equality). Fresh committed control is complete / passed; exact-head CI for the replay passed all 14 applicable checks; release-tag-only check skipped. The preceding main commit passed all 13 CI jobs before this merge. Baseline implementation remains deferred.

Post-merge main verification

Squash-merged as d2506bec6b9162d9b09e3141c3bf92aff238726c. The main tree exactly matches the reviewed PR head. Post-merge targeted tests passed: 142 tests. Fresh committed verification on that main commit returned complete / passed. Main CI run completed successfully with all 13 jobs passed. Baseline, corpus, ledger, Q2 and released-build evaluation remain deferred.