[codex] Harden agent memory rights validation

[8Dionysus]

Summary

• Reject unsafe default writes to core/frozen memory scopes.
• Require explicit transition rights for promote/demote/rescue/freeze flows.
• Add validation tests for memory handoff and lifecycle rights posture.

Checks

• python scripts/validate_agents.py
• python -m pytest -q tests
• git diff --check