[nicoloboschi]

Closes #4916.

Problem: with Hindsight holding OpenClaw's memory slot, OpenClaw's own memory surfaces (memory.status, the Memory page, gateway memory.search / memory.get) reported "memory plugin unavailable". The plugin never registered a memory capability.

Change: register OpenClaw 2026.10's provider-neutral providerRuntime (src/memory-provider.ts), with health, search and get backed by Hindsight recall and GET /memories/{id}.

Narrow on purpose:

• No Active Memory candidates. Active Memory would recall before replies on top of autoRecall. No pre-compaction flush: every turn is already retained.
• Who can read. An agent-only bank holds every conversation of that agent, so search/get answer only an operator or the agent owner's private session (owner-private audience). A group conversation, a session without an audience, or host authority is refused with an error, never an empty result.
• Which bank. Search runs only when the bank depends on the agent alone (agentBankMap, static bank, dynamicBankGranularity: ["agent"]). With user or channel banking (the default), search is refused rather than guessing a user's bank. health() answers everyone and reveals no content.
• Older hosts ignore registerMemoryCapability({ providerRuntime }).

This replaces #4917's approach, which faked OpenClaw's file-shaped legacy runtime (+752 lines). 2026.10 added an interface for record-based providers like ours.

Tests: memory-provider.test.ts covers access rules, minScore/maxResults, foreign references, health for non-readers, and agentOnlyBankId for every granularity.

Verified on real OpenClaw 2026.10.2 (local Hindsight API, agent-only banking):

• memory.status (agentId main): {"providerId":"hindsight-openclaw","status":"ready"}. Before this change it was "memory plugin unavailable".
• memory.search v2 "favourite fruit" returns the fact just retained from a web-chat turn ("User's favorite fruit is persimmon…", score 1.1).
• memory.get returns that memory's text; an unknown id returns not_found.
• With dynamicBankGranularity: ["agent","user"], status is still ready and search fails with "Hindsight banks here are keyed by user or channel…".
• OpenClaw 2026.9.6 loads the build with no errors and still retains turns.
• doctor.memory.status through a raw gateway call reports "requires authenticated operator authority". That message comes from OpenClaw's doctor, which needs an operator session; the CLI token connection doesn't have one.