fix(memory): guard local uploads against credential reads

[teknium1]

Summary

Salvage of #57841 by @necoweb3 (cherry-picked onto current main, authorship preserved). Memory-provider local upload tools now route model-supplied local paths through the shared agent.file_safety.raise_if_read_blocked() guard before reading bytes, so credential stores (~/.hermes/auth.json, .env, etc.) can no longer leave the machine via memory-backend upload APIs.

Changes

• plugins/memory/retaindb/__init__.py: retaindb_upload_file calls the read guard before read_bytes(); blocked paths return a clear error.
• plugins/memory/openviking/__init__.py: viking_add_resource guards single-file uploads; _zip_directory skips read-denied files when building directory archives (symlinks were already skipped).
• Regression tests: blocked credential store rejected (client never called), directory zip excludes credential files, ordinary files still upload.

Validation

Check	Result
tests/plugins/memory/test_retaindb_provider.py + test_openviking_provider.py	137 passed, 0 failed
E2E (real imports, temp HERMES_HOME): auth.json direct, .env anywhere, symlink disguise, mixed-dir zip	all blocked; zip contains only safe files
E2E positive control: ordinary file upload	unchanged, uploads

Plugin-directories-only diff — no core files touched. Same defense-in-depth chokepoint as #57698 (image/video-gen) and #58709 (vision/video analyze).

Closes #57841.

Infographic