feat(memory): scheduled backup of AgentCore Memory to S3

**Context:** ROADMAP.md → Memory security → Memory backup to S3

---

## Component

CDK / infrastructure

## Describe the feature

**Scheduled export** of AgentCore Memory namespaces to **versioned S3** for disaster recovery and pre-poisoning restore.

## Use case

Operators need point-in-time restore after bad extraction, operator error, or platform incident. Compliance may require durable memory archives.

## Proposed solution

1. EventBridge-scheduled Lambda export per repo namespace.
2. S3 bucket with versioning + lifecycle; IAM least-privilege.
3. Restore API used by quarantine/rollback draft.
4. Metrics on backup success/failure; alarm on missed runs.
5. Document RPO/RTO expectations in `docs/design/SECURITY.md`.

## Other information

- Design context: `docs/design/MEMORY.md`, `docs/design/SECURITY.md`.

- [ ] This might be a breaking change

Start with docs/design/MEMORY.md and docs/design/SECURITY.md, then inspect the CDK/infrastructure entry points for existing memory, storage, and scheduling resources. Define the design and implementation boundaries for scheduled namespace exports, versioned S3 retention, restore integration, least-privilege IAM, metrics, alarms, and RPO/RTO documentation; done means these requirements are addressed coherently.

Written by the indexing model from the issue text.