fix: validate memory source event provenance

[dajiaohuang]

Problem

memory_change accepted fabricated source_event_ids even though provenance is supposed to bind facts to authoritative branch events. That allowed nonexistent, cross-campaign, or cross-branch evidence references to enter long-term memory, and could also expose a restricted event identifier through a player-visible fact.

Solution

• validate every explicitly supplied fact source event before mutation
• resolve events through the selected branch, including snapshot-inherited history
• reject nonexistent, cross-campaign, and cross-branch references with an actionable field path
• prevent player-visible memory from citing DM- or actor-only events
• apply the same guard to atomic commit facts and regular add/upsert/revise/retract/forget writes
• preserve exact idempotency replay, stale campaign guards, revision heads, and existing writes that omit source_event_ids

Verification

• focused memory lifecycle/provenance regressions: 3 passed
• full Domain suite: 92 passed
• full MCP suite: 91 passed
• uv run ruff check packages/domain packages/mcp
• git diff --check

The regression covers valid add/revise and replay, fabricated IDs, cross-campaign IDs, cross-branch IDs, restricted-source disclosure, stale revisions, atomic commit rollback, unchanged campaign revision, unchanged event log, and unchanged memory heads after rejection.

Closes #30