feat: claude-memory-sync — back up Claude Code auto-memory to its own private repo

Auto-memory (~/.claude/projects/*/memory, 774 files across 49 projects) goes to
gitea vh/claude-memory, not this repo. The git dir is ~/claude-memory.git and its
work tree is ~/.claude/projects, and exclude rules admit only memory/ folders, so
transcripts stay local and nothing is added inside ~/.claude.

- home_root/.local/bin/claude-memory-sync: commit, rebase onto origin, push, under
  a flock; --status; --init for a fresh machine. Every run records its result
  for the drift check.
- home_config/systemd/user/claude-memory-sync.{service,timer}: hourly with
  Persistent=true. Linked but not yet enabled.
- link-dotfiles --check now also reports uncommitted changes (a stale session
  can write old content back through an intact link) and a failed or stale
  (>3h) memory sync.
- CLAUDE.md and README document the backup and the never-put-credentials-in-memory rule.

home_root/.claude/CLAUDE.md

@@ -16,7 +16,16 @@ applies to every other linked file: in `~/.claude` that is
 `settings.json`, `statusline-command.sh`, `CONTEXT.md`,
 `keybindings.json`, `bin/ratecheck` and `skills/australis-design`, plus
 `~/.zshrc`, `~/.zshenv` and `~/.gitconfig`. `~/dotfiles/link-dotfiles
---check` reports any file that has come loose, and any dangling link.
+--check` reports any file that has come loose, any dangling link, any
+uncommitted change, and a stale auto-memory backup. A long-running
+session can write its stale copy of `settings.json` back through the link,
+so re-check after editing user settings.
+
+**Auto-memory** (`~/.claude/projects/*/memory`) is backed up hourly to
+the private gitea repo `vh/claude-memory` by `claude-memory-sync` (git
+dir `~/claude-memory.git`; `--status` shows the last run). Transcripts
+stay local. **Never write a credential into a memory file:** memory is
+copied off-box.
 
 ## Operator identity