feat: claude-memory-sync — back up Claude Code auto-memory to its own private repo

Auto-memory (~/.claude/projects/*/memory, 774 files across 49 projects) goes to
gitea vh/claude-memory, not this repo. The git dir is ~/claude-memory.git and its
work tree is ~/.claude/projects, and exclude rules admit only memory/ folders, so
transcripts stay local and nothing is added inside ~/.claude.

- home_root/.local/bin/claude-memory-sync: commit, rebase onto origin, push, under
  a flock; --status; --init for a fresh machine. Every run records its result
  for the drift check.
- home_config/systemd/user/claude-memory-sync.{service,timer}: hourly with
  Persistent=true. Linked but not yet enabled.
- link-dotfiles --check now also reports uncommitted changes (a stale session
  can write old content back through an intact link) and a failed or stale
  (>3h) memory sync.
- CLAUDE.md and README document the backup and the never-put-credentials-in-memory rule.

README.md

@@ -66,6 +66,26 @@ write through a link and names the target, which is the safe behaviour. Claude
 Code may also rewrite `settings.json` itself when settings change from inside the
 app. After that, or whenever in doubt, run `./link-dotfiles --check`.
 
+## Claude Code auto-memory (separate private repo)
+
+Auto-memory (`~/.claude/projects/*/memory`) is backed up to gitea
+`vh/claude-memory`, not to this repo, because it changes constantly and holds
+operational detail. `home_root/.local/bin/claude-memory-sync` does the work. Its
+git dir is `~/claude-memory.git` and its work tree is `~/.claude/projects`, and
+exclude rules admit only the `memory/` folders, so transcripts never leave the
+machine and nothing extra appears inside `~/.claude`.
+
+```bash
+claude-memory-sync            # commit, rebase onto the remote, push
+claude-memory-sync --status   # last run + uncommitted count
+claude-memory-sync --init     # fresh machine: clone and wire up
+systemctl --user enable --now claude-memory-sync.timer   # hourly (unit files in home_config/systemd/user)
+```
+
+Project folders are named after absolute paths, so memory lines up across Linux
+boxes; macOS (`/Users/...`) gets its own folders. `./link-dotfiles --check` flags a
+failed or stale (>3h) sync.
+
 ## Windows (PowerShell)
 
 `stow` doesn't run natively on Windows, so use the PowerShell equivalent. It