feat(memory): bind the memory engine as a loadable TinyBus module - #5512

All three prior findings are resolved. The new commits add meaningful behavioural tests: the binding tests pin the reported class under both feature configurations, the boot tests pin the eager-load predicate in both directions, the guard tests pin the Module pass-through, and the adapter tests cover every serde crossing and the security-critical error mappings. Error paths that cannot be exercised without a real module (proxy resolution, verify cross-check, the adapter's fail-closed capabilities/health fallbacks) are explicitly out of scope per the test comments, and the from_boot_policy + no-policy error path is untestable in isolation because OnceLock cannot be reset. The change looks sound. (3 earlier finding(s) still open) The code index for this repository is cold, so this review saw the diff alone.

No findings.

Fixed since the last review

• Round-trip test claims to fill every field but uses Default for the rest — fixed: round_trip_preserves_every_field now populates every field with non-default values and the comment explicitly states ..Default::default() is deliberately not used.
• Cover ExportRecord, ImportOutcome and SourceScope serde crossings — fixed: three new tests (an_export_record_survives_the_crossing_with_its_payload_and_taint, an_import_outcome_survives_the_crossing_with_its_counts_and_errors, a_source_scope_survives_the_crossing_with_every_allowed_source) round-trip each type and assert equality.
• Pin the Module pass-through policy in redact_outbound — fixed: guard_does_not_redact_for_a_module_driver and guard_does_not_redact_json_for_a_module_driver assert byte-identical pass-through and that the result is Cow::Borrowed.