feat(memory): add scoped paths and tools-only holographic mode

[advaitbd]

Summary

Adds two opt-in controls to the bundled Holographic memory provider:

• db_path_template for privacy-safe SQLite separation using sanitized {profile}, {platform}, {chat}, and {user} placeholders
• memory_mode: tools to keep explicit fact_store and fact_feedback tools while disabling automatic prefetch

Existing db_path and hybrid behavior remain the defaults.

Why

A gateway profile can serve both private DMs and shared groups. Profile- or user-scoped memory can therefore cross the actual conversational privacy boundary, while session-scoped storage loses continuity after /new. A chat-scoped SQLite path preserves continuity within one conversation and separates DMs from groups without adding a daemon or remote service.

Tools-only mode supports conservative deployments that want explicit writes and reads before enabling automatic context injection.

Example

plugins:
  hermes-memory-store:
    db_path_template: $HERMES_HOME/holographic/{profile}/{platform}/{chat}.db
    memory_mode: tools
    auto_extract: false

Compatibility and safety

• db_path_template is opt-in and takes precedence only when configured
• placeholder values are reduced to safe path segments
• invalid templates fail back to the configured db_path
• memory_mode defaults to hybrid
• no automatic migration or provider activation

Tests

54 passed in 9.25s

Focused coverage includes DM/group separation, path sanitization, legacy db_path behavior, tools-only prefetch suppression, explicit tool availability, auto-extraction, retrieval, SQLite shutdown, and vector persistence.

Related work

• feat(memory): add per-user scoping to holographic memory plugin #10427 adds per-user row scoping to Holographic for API-server deployments. It does not expose chat identity and therefore cannot separate one user's private DM from a shared group.
• feat(memory): per-chat/per-user/per-session memory scope isolation #62841 proposes generic memory scopes but currently enables non-identity scopes only for Supermemory. This provider-local patch is deliberately small and can be adapted to the generic scope mechanism if that lands.

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

feat(memory): add scoped paths and tools-only holographic mode

1. plugins/memory/holographic/__init__.py _sanitize_path_segment: distinct identifiers collapse to the same segment (dm/../../123, dm-123, dm 123 → dm-123), so two different chats/users silently share one DB file — the opposite of the privacy intent. Consider appending a short hash of the raw value whenever a transformation occurs, or documenting the collision behavior in the README.
2. tools mode: initialize() still builds the full _store/_retriever (HRR arrays, etc.) even though prefetch() short-circuits immediately. Skipping retrieval-state construction when memory_mode == "tools" would avoid allocating state that can never be used.
3. _resolve_db_path silently falls back to db_path on any format error (warning only). A typo in a placeholder (e.g. {chat_id} instead of {chat}) therefore routes all chats into the legacy shared DB without any user-visible signal — the privacy promise of the template is silently lost. Consider surfacing this in config validation or failing loudly.
4. Minor: user=kwargs.get("user_id_alt") or kwargs.get("user_id", "") → empty user id becomes "unknown", so all users without an id share the {user} segment. Acceptable, but worth a line in the docs since it affects the scoping guarantee.