repo-memory: temporary IDs (aw_XXX) not substituted with real item numbers before git commit

## Problem

When an agent writes `aw_XXXXXXXX` temporary ID placeholders into repo-memory files (e.g. a work-item ledger), those placeholders are **not resolved to real GitHub item numbers** before the memory is committed to git.

The `push_repo_memory` job currently depends only on `agent` and `activation` (plus `detection` when enabled). It runs in parallel with the safe-output jobs, so by the time it commits repo-memory files to the memory branch, no safe-output job has yet resolved temporary IDs to real issue/PR numbers.

### Concrete example

A farm/factory agent tracks work items in repo memory:

```
n-plus-1|issues|get_issues|aw_abc12345 --> (pending)
n-plus-1|issues|set_issues|aw_def67890 --> (pending)
```

What should be committed after safe-outputs complete:

```
n-plus-1|issues|get_issues|aw_abc12345 --> PR 49492
n-plus-1|issues|set_issues|aw_def67890 --> PR 49494
```

But today the unresolved placeholders are what land in git.

## What exists today

The temporary ID system is fully implemented for safe-output-to-safe-output resolution:

- Agent emits `temporary_id` fields on `create_issue`/`create_pull_request` messages
- Safe-output jobs build a `temporary_id → {repo, number}` map in `GH_AW_TEMPORARY_ID_MAP` / `/tmp/gh-aw/temporary-id-map.json`
- Downstream safe-output steps (e.g. `link_sub_issue`, `add_comment`) read the map and resolve `aw_XXX` references before making API calls
- `replaceTemporaryIdReferences()` utility already exists in `temporary_id.cjs`
- The manifest (`safe-output-manifest.jsonl`) records each created item with its resolved number and `temporaryId`

The gap is that none of this flows into `push_repo_memory`.

## Proposed fix

1. **Sequence `push_repo_memory` after safe-output jobs**: add the safe-output job name(s) to `push_repo_memory`'s `needs` array so it runs after items are created and the temporary ID map is available.

2. **Pass the temporary ID map to `push_repo_memory.cjs`**: inject `GH_AW_TEMPORARY_ID_MAP` (from the safe-output job's output) into the push step environment.

3. **Apply substitution before committing**: call `replaceTemporaryIdReferences()` on each repo-memory file's text content before staging the commit, so real numbers land in git.

## Files involved

- `pkg/workflow/repo_memory.go` — `buildPushRepoMemoryJob`: add safe-output job to `needs` and pass env var
- `pkg/workflow/compiler_jobs.go` — `buildPushRepoMemoryJobWrapper`: thread through the safe-output job name
- `actions/setup/js/push_repo_memory.cjs` — apply `replaceTemporaryIdReferences()` to file contents before commit
- `actions/setup/js/temporary_id.cjs` — `replaceTemporaryIdReferences()` (already exists, just needs to be called)