Memory visibility private or shared; drop public per memory and organization memories #321

Domain change from #309 (Decision 1), split out of #315 so that the v2 tool surface (#310) did not wait for it. Start with #309, section "Continue here".

State today

The item_store description already lists visibility (private, shared), but the server still accepts public: ItemStoreTools treats shared and public alike (CreateMemory, ChangeMemory and the memory batch paths), and the Memory Batch v1 schema still allows public and organization scope. recall takes only public memories of a public upstream (RecallText.Compose).

Work

• Visibility values private and shared only. public is refused on create with a message naming the two values, in item_store, both batch formats and the web forms. Visibility is fixed after creation; a change is refused.
• shared means: everyone with access to the project, directly or through its organization, and everyone when the project is public. The web app states next to shared that it is visible to everyone in a public project.
• Organization memories can no longer be created, via MCP or web. Organization-wide guidance lives in the organization's agent instructions.
• Migration of existing data:
  • Project memories with public become shared.
  • Organization memories (OrganizationId set) stay readable to their owner but are listed on the organization page with a move action: into a project of the organization (as shared) or into the organization's agent instructions. The owner decides per memory; nothing is moved automatically. Record how many exist before the switch.
• Upstream recall of a fork takes the shared memories of a public upstream; a private upstream shares nothing.
• recall, the item_list visibility filter, search and the memory forms use the two values; Scope and OrganizationId on MemoryEntry are removed once no organization memory remains.
• Memory Batch v1 stays accepted: its public maps to shared, and organization scope is refused with a pointer to the organization's instructions. Update /schemas/conderis-memory-batch-v1.schema.json descriptions accordingly without breaking existing files.
• System guide (bump SystemGuide.Version), server instructions, /guide (its "Choose who should know" section still names an Organization option) and a short addition to the release note #325.

Acceptance

• Creating a public memory or an organization memory is refused over MCP and impossible in the web.
• After migration no memory has visibility public; every former organization memory is either moved or still listed with its move action.
• A fork of a public project recalls the upstream's shared memories; a fork of a private project recalls none of the upstream's memories. Both tested.
• Visibility and isolation tests (users, keys, web, MCP) ported to the two values.
• Migration checked against LocalDB (#283); deployed after the owner agrees (#282).