test(core): add retrieval leakage regression suite

[kunickiaj]

Description

Adds a single mixed-domain fixture (`seedMixedScopeFixture`) and uses it to drive leakage regression tests across every memory exposure path: store get/recent/search/timeline/explain, semanticSearch, pack, export, MCP direct reads, and viewer `/api/memory` / `/api/observations` / `/api/pack`. The fixture seeds three memories (local-default personal, authorized work scope, and an unauthorized OSS scope without local membership) and asserts that the unauthorized memory cannot reach any read surface.

Implements codemem-ov4g.5.6.

Type of Change

• 🧪 Testing (test-only changes)

Testing

• Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test`)
• Added/updated tests for changes
• Manually verified changes work as expected

Checklist

• Code follows project style (`pnpm run lint` passes for touched files)
• Self-review completed
• Documentation updated (if needed)
• No new warnings introduced

[kunickiaj]

• test(core): add retrieval leakage regression suite #1038 👈 (View in Graphite)
• fix(core): enforce scope-aware export import #1037
• fix(api): enforce scope-safe viewer and CLI memory access #1036
• fix(mcp): enforce scope-safe memory tools #1035
• test(plugin): guard scoped OpenCode context injection #1034
• fix(core): harden memory pack scope assembly #1033
• fix(core): scope sqlite-vec semantic retrieval #1032
• fix(core): enforce scope visibility in memory retrieval #1031
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[kunickiaj]

Merge activity

• May 5, 2:59 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 5, 3:21 PM UTC: Graphite rebased this pull request as part of a merge.
• May 5, 3:22 PM UTC: @kunickiaj merged this pull request with Graphite.