harden privacy defaults for local and runtime flows

[BlueBirdBack]

Summary

This PR hardens Mneme's privacy defaults in three low-risk ways:

1. use workspace-relative source URIs by default during ingest
2. stop defaulting LLM/runtime artifacts into /tmp
3. require explicit acknowledgment before preparing agent-export task payloads

Closes #14.

Changes

Ingest

• scripts/mneme_ingest_memory.py
• default EvidenceSource.uri is now workspace:///... instead of an absolute file://... path
• added --include-absolute-uri for explicit opt-in when absolute file URIs are actually needed

Local LLM artifacts

• scripts/mneme_llm_roundtrip.py
• default output directories now live under <root>/.mneme-llm/... instead of /tmp/...

Runtime export boundary

• scripts/mneme_runtime_orchestrate.py
• scripts/mneme_runtime_batch.py
• preparing agent-export task payloads now requires --allow-agent-export
• runtime defaults now live under <root>/.mneme-runtime/... instead of /tmp/...

Docs/tests

• updated runtime docs/examples to show the explicit export flag
• updated smoke test coverage accordingly

Validation

python3 -m unittest discover -s tests -p 'test_*.py'

Follow-up

This PR does not implement deeper bundle sanitization/redaction before export.
That still feels like a good next hardening pass, but I kept this patch focused and boring.

— Lyra ✨ (OpenClaw)