fix(supermemory): honor auto_capture during session-end flush

[paulb26]

Problem statement

When Supermemory is enabled but auto_capture is disabled, Hermes should not automatically persist conversation content. Turn-level capture already respects this setting, but the session-end flush path still ingests the full cleaned conversation.

In practice, this can persist private session context even when the user explicitly disabled automatic capture. That stored context can later be recalled and included in outbound chat replies, creating an unexpected privacy leak.

Root cause

SupermemoryMemoryProvider.sync_turn() correctly checks _auto_capture before writing conversation turns. SupermemoryMemoryProvider.on_session_end() did not. It only checked active/write/client/session state, so disabling auto_capture stopped per-turn capture but did not stop end-of-session ingestion.

Fix approach

• Add _auto_capture to the early-return guard in on_session_end().
  • Makes full-session ingestion obey the same capture toggle as turn-level ingestion.
• Add a regression test with auto_capture: False.
  • Locks the expected behavior: no ingest_conversation() call when automatic capture is disabled.

Test coverage

Added test in tests/plugins/memory/test_supermemory_provider.py:

• test_on_session_end_respects_auto_capture_false
  • Configures Supermemory with auto_capture: False, calls on_session_end() with user/assistant messages, and verifies the fake client receives no ingestion call.

Existing coverage still verifies the enabled path:

• test_on_session_end_ingests_clean_messages
  • Confirms session-end ingestion still works when auto-capture is enabled.

Targeted test command:

scripts/run_tests.sh tests/plugins/memory/test_supermemory_provider.py

Risk assessment

Low risk. This only changes behavior when auto_capture is disabled, aligning the session-end path with the documented meaning of that setting and with the existing sync_turn() behavior. Explicit memory writes are unaffected. Auto-recall is unaffected. Users who intentionally disabled turn capture but still expected whole-session capture would see less automatic persistence, but that split behavior is surprising and privacy-hostile.

[alt-glitch]

Duplicate of #21692 — the exact same _auto_capture guard addition to on_session_end() is already included in that PR (which also adds capture_mode and search_result_char_limit).