fix: retry safe memory reads without retrying writes

[viowai]

Summary

Fix the agent SDK's unreachable transport retry path and make retry eligibility depend on explicit request semantics rather than HTTP method alone. Preserve redacted structured diagnostics through the generic MCP adapter while keeping all memory writes single-attempt.

Changes

• Add safe_read and non_idempotent_write request semantics with a hard allowlist for POST /mem/search and /mem/context.
• Retry safe reads at most once for transport failures, HTTP 429, and HTTP 5xx inside the original timeout budget; honor Retry-After only when it fits that budget.
• Prevent POST write paths from retrying even if a caller incorrectly requests safe-read semantics.
• Add redacted EvermeError fields for classification, cause code, HTTP status, request id, attempts, retryability, and elapsed time.
• Project those fields to MCP structuredContent.error while preserving the existing isError text response.
• Document the public SDK/MCP contracts and add regression coverage for socket reset, DNS, timeout budget, 429, 5xx, auth classification, and write single-attempt behavior.

Test Plan

• CLI tests not required (cli/ is unchanged)
• Plugin workspace tests pass: npm test --workspaces --if-present
• Agent SDK tests pass: 56 tests
• Memory MCP tests pass: 38 tests
• npm audit --audit-level=moderate reports 0 vulnerabilities
• Manual synthetic verification completed with no production endpoint or data

Security

• No real emk_*, evt_*, cookies, private URLs, production logs, memory queries, or request bodies are included
• Native fetch cause text and request URLs are not projected into structured diagnostics
• Non-idempotent writes remain single-attempt

Related Issues

• Fixes fix: MCP safe reads do not retry transport failures or preserve diagnostics #4
• Separate from [Cloud API] Queued agent-memory writes lack a usable task_id or exact visibility proof EverOS#338 (ingestion task metadata and exact visibility verification)

Release Note

The code change is backward-compatible and does not bump package versions in this PR. A maintainer release of aligned @everme/agent-sdk and @everme/memory-mcp packages is still required before downstream hosts can pin the fix and remove temporary host-side guards.