feat(memory): quarantine and rollback operator API

**Context:** ROADMAP.md → Memory security → Quarantine and rollback

---

## Component

API or orchestration

## Describe the feature

**Operator API** to isolate suspicious memory entries (quarantine) and restore **pre-task snapshots** (rollback) for a repo namespace.

## Use case

After detecting poisoning or bad extraction, operators must stop bad memories from affecting new tasks and optionally restore a known-good state.

## Proposed solution

1. `POST /memory/quarantine` — by entry ID, pattern, or time range.
2. `POST /memory/rollback` — restore from S3 backup snapshot (requires backup draft).
3. CLI: `bgagent memory quarantine|rollback`.
4. Audit events for all operator actions.
5. Cedar-gated operator role.

## Other information

- Depends on **memory backup to S3** for rollback.
- Design context: `docs/design/MEMORY.md`, `docs/design/SECURITY.md`.

- [ ] This might be a breaking change

Start with ROADMAP.md under “Memory security,” then read docs/design/MEMORY.md and docs/design/SECURITY.md. Trace the existing memory API, CLI, backup, audit, and authorization entry points before deciding scope. Done means the quarantine and rollback operator flows, CLI commands, audit events, and Cedar-gated operator role are designed and implemented with the S3 backup dependency addressed.

Written by the indexing model from the issue text.