feat(webhooks): SIEM enrichment fields on MemoryDefenseEventData

[chrislatimer]

Summary

Adds optional SIEM-enrichment fields to MemoryDefenseEventData AND wires the OSS regex defense to populate them. SIEM receivers now get a fingerprinted preview of every matched secret on every memory_defense.triggered delivery — straight from OSS, no extension required.

Schema changes (commit 1)

Five optional fields on MemoryDefenseEventData so downstream extensions (e.g. hindsight-cloud) can surface the per-decision context SIEM operators need to act on a leaked-secret webhook, without a separate event type:

• severity: low|medium|high|critical
• api_key_name: human-readable name of the Hindsight API key that submitted the retain — so InfoSec can identify the agent / integration responsible
• hits: list of MemoryDefenseHit { detector, preview } per match, where preview is a fingerprinted rendering (ghp_AAAA...BBBB). Never the raw secret; MemoryDefenseHit validates both fields present so an extension can't accidentally post the raw value as the only field
• memory_unit_id: drill-down pointer for REDACT decisions
• receipt_uri: pointer into the audit trail

All five fields default to None — existing OSS receivers see no shape change. Receivers should treat absence as "not provided" rather than "no match".

OSS populates hits[] (commit 2)

Three changes to surface fingerprinted previews on the OSS payload itself, so OSS users have SIEM-actionable data without needing the cloud extension:

• New _fingerprint_value helper with length-aware bucketing (< 6 chars: redact entirely; 6–15: first-2 + ellipsis + last-2; > 15: first-4 + ellipsis + last-4). Raw value never appears in output.
• apply_redaction returns a hits list — one entry per matched substring (so two GitHub tokens in the same content produce two hits, not a single collapsed label).
• Orchestrator's _fire_memory_defense_webhook translates the decision's raw hit dicts into MemoryDefenseHit entries on the wire. None when no per-hit data exists so receivers can distinguish "no preview info" from a hypothetical empty list.

Motivation

This closes the gap that previously motivated keeping a separate memory_defense.violation event in cloud (before the consolidation that landed in #2077). Cloud and OSS can now ship the same SIEM-actionable payload through the canonical memory_defense.triggered envelope — one event type, one receiver code path, full enrichment from whichever layer is active.

Test plan

• Schema tests in test_webhooks.py:
  • Five base fields round-trip; five new fields default to None.
  • Enrichment fields populate cleanly through WebhookEvent JSON serialisation.
  • MemoryDefenseHit validates both detector and preview are present.
• Fingerprinting unit tests in test_memory_defense.py:
  • _fingerprint_value across all three length buckets (parametrized).
  • apply_redaction produces per-match fingerprinted previews; raw secret never present.
  • Multiple matches of the same pattern produce multiple hits.
• Extended test_screen_redacts_secret to assert the regex extension passes hits onto DefenseDecision.
• Extended test_retain_fires_webhook_on_redact to assert the wire payload carries hits[] with the correct fingerprint.
• Existing memory-defense webhook flow tests still green: test_retain_fires_webhook_on_block.
• Full test_memory_defense.py + test_webhooks.py: 100 passed.
• ruff check + ty check clean.