feat(memory): bind the memory engine as a loadable TinyBus module - #5512

The three prior findings are all resolved in this revision, and the remaining changes look sound. The new binding logic correctly reports Null (not Module) when the modules feature is off, gated by a test in each direction. The boot-time should_eager_load gate prevents TinyMemory from being eagerly downloaded on hosts that never bind the module driver, with tests for both the embedded and module-backed cases. The set_modules_policy process-global is published before binding and defaults to disabled-when-unset, which is fail-closed. The adapter tests now cover every serde-crossing type with non-default values, and the error-mapping tests pin the security-relevant variants (PathEscape stays PathEscape, unrecognised names degrade to Other not Invalid). No new blocking issues found in this diff. (3 earlier finding(s) still open) The code index for this repository is cold, so this review saw the diff alone.

No findings.

Fixed since the last review

• Round-trip test claims to fill every field but uses Default for the rest — fixed. round_trip_preserves_every_field in module_adapter_tests.rs now populates every field of OwnedRecallOpts with non-default values and explicitly avoids ..Default::default(), with a comment explaining why.
• Cover ExportRecord, ImportOutcome and SourceScope serde crossings — fixed. Dedicated round-trip tests now exist for each type: an_export_record_survives_the_crossing_with_its_payload_and_taint, an_import_outcome_survives_the_crossing_with_its_counts_and_errors, a_source_scope_survives_the_crossing_with_every_allowed_source, plus an_export_page_survives_the_crossing_with_its_cursor.
• Pin the Module pass-through policy in redact_outbound — fixed. guard_does_not_redact_for_a_module_driver and guard_does_not_redact_json_for_a_module_driver in policy_tests.rs explicitly assert that DriverClass::Module stays in the no-op group and returns Cow::Borrowed.