feat: agent-driven export + cross-clone memory (v0.10.0)

[rumitvn]

Why

Two real-world gaps surfaced from daily use:

1. The assistant couldn't close the share loop. After pin_fact / graduate_fact, the data only lived in the sidecar — publishing required dropping to a terminal for tre share. That one manual hop broke the "let the agent do it" flow.
2. Memory didn't cross clones of one repo. Identity was basename(cwd), so app, app-2, app-3 (parallel clones) were three isolated projects.

What's in this PR

A — Agent-driven export (MCP)

• export_memory — reuses exportSync + shareToGit({commit:true, push:false}): writes .tre-mem/ and makes a local commit, never pushes (returns the exact git push… command). Fail-closed on secrets: a blocked export returns the matched secret categories, never the values, and writes nothing.
• get_share_status — pending / shared / graduated counts so the agent can nudge you to export.
• graduate_fact result gains a hint pointing at export_memory.

B — Cross-clone memory by git remote (default-on; TRE_MEM_CROSS_CLONE=0 to disable)

• Clones sharing an identical remote.origin.url union their memory (branch tags, pins, graduated facts, claude-mem observations).
• Approach: read-time alias union, not a stored-key rewrite — writes keep using basename(cwd); reads expand to project IN (alias set). Forced by constraints (claude-mem observations are permanently basename-keyed; committed .tre-mem/ JSONL carries project). Payoff: on-disk format + SYNC_SCHEMA_VERSION unchanged → zero teammate impact, one additive schema column.
• New src/git/remote.ts (canonicalizeRemoteUrl → host/org/repo, remoteSlug) and src/store/aliases.ts (resolveProjectIdentity, crossCloneEnabled).
• Schema v3: additive nullable branch_state.remote + index, idempotent self-heal mirroring v2 (no backfill).
• repo: projectAliases, *Across(projects[]) readers, setRemoteForCwd, remoteForProject; adapter/retrieval refactored project: string → projects: string[] (= @project → IN (…)).
• Any tre invocation eagerly registers the current clone's remote; the web resolves aliases per requested project, so the dashboard picker unions correctly too (not just the daemon's home project).

C — Visibility

• tre status prints remote: and linked clones (N): ….
• /api/health + /api/branches carry remote / linked_clones; dashboard topbar shows a 🔗 N clones chip.

Test plan

• format:check · lint · typecheck · 366 tests · build — full pre-push gate green
• New suites: git-remote, store-aliases, mcp-export-crossclone (export commit-no-push, redaction fail-closed, share-status, graduate hint, cross-clone surfacing + isolation), plus v3 migration + repo alias/*Across cases
• projects[] migration covered across adapter/retrieval/web/mcp fixtures
• Live: tre status in a gops clone shows linked clones (4); /api/branches?project=go-ps-app-dev returns 4 linked clones / 20 unioned branches
• Reviewer: confirm TRE_MEM_CROSS_CLONE=0 restores per-directory isolation
• Reviewer: confirm exported .tre-mem/ JSONL is byte-identical to pre-change output (teammate-safety)

Notes

• SSOT: PLAN-PHASE7.md. Version 0.9.0 → 0.10.0; CHANGELOG [0.10.0].