epic(memory): memory security hardening

**Context:** ROADMAP.md → Memory security (entire section)
**Related:** #27 (review feedback memory), #26 (closed input hardening)

---

## Component

Agent (Python runtime)

## Describe the feature

Epic tracking **memory security** capabilities for AgentCore Memory: trust-aware retrieval, decay, anomaly detection, quarantine, write-ahead validation, review quorum, backup, extraction replay, and optional knowledge graph (tier 4).

## Use case

Memory is a learning surface and an attack surface. Poisoned or stale memories degrade agent quality or enable prompt injection persistence. Operators need detect-and-respond controls without blocking the fail-open execution path for normal tasks.

## Proposed solution

Child issues (file separately):

| Child draft | Capability |
|-------------|------------|
| [memory-trust-aware-retrieval.md](./memory-trust-aware-retrieval.md) | Trust-aware retrieval |
| [memory-temporal-decay.md](./memory-temporal-decay.md) | Temporal decay |
| [memory-anomaly-detection.md](./memory-anomaly-detection.md) | Anomaly detection |
| [memory-quarantine-and-rollback.md](./memory-quarantine-and-rollback.md) | Quarantine and rollback |
| [memory-write-ahead-validation.md](./memory-write-ahead-validation.md) | Write-ahead validation |
| [memory-review-feedback-quorum.md](./memory-review-feedback-quorum.md) | Review feedback quorum |
| [memory-backup-to-s3.md](./memory-backup-to-s3.md) | Memory backup to S3 |
| [memory-extraction-replay.md](./memory-extraction-replay.md) | Memory extraction replay |
| [memory-structured-knowledge-graph.md](./memory-structured-knowledge-graph.md) | Structured knowledge graph (tier 4) |

Ship incrementally; memory writes remain fail-open for task execution unless operator enables enforce mode per repo.

## Other information

- Design context: `docs/design/MEMORY.md`, `docs/design/SECURITY.md`.
- #27 implements acquisition; this epic implements **security and lifecycle**.

- [ ] This might be a breaking change

Comienza con ROADMAP.md y la sección de seguridad de memory; después, lee docs/design/MEMORY.md y docs/design/SECURITY.md. Revisa los borradores secundarios enumerados para comprender las capacidades independientes y su alcance incremental. Se considera terminado cuando el epic está dividido en issues secundarios implementables, conservando el valor predeterminado fail-open y el modo enforce opcional.

Escrito por el modelo de indexación a partir del texto del issue.