feat: memory consolidation step 1 — pending_review age expiry (B4)

[jkyberneees]

Summary

• Unconfirmed pending-review inferences accumulated until the count cap (default 20) pushed them out — and the cap keeps the NEWEST, so stale chains rode in the protected memory head indefinitely (visible every turn in the USER MODEL block).
• New knob user_state_pending_max_age_days (*int, default 14, explicit 0 = never expire): applyDiff prunes unconfirmed entries older than the window, BEFORE the count trim so stale entries can't evict fresh ones.
• Confirmed facts are never touched; no LLM involved — the smallest safe consolidation step (B4 of the T3 roadmap).

Review-found fixes (3-judge panel)

• MAJOR (all 3 judges converged): plain int + != 0 Resolve guard made the documented '0 disables' unreachable; field is *int now with a JSON→Resolve→disable contract test.
• Expiry reordered before the count cap trim.
• Security cleared: confirmed/promoted items never pass through PendingReview; IPI flood bounded better (count + age); knob is operator-config-only (project odek.json memory sections are nulled).

Test plan

• RED-first: internal/memory/extended/pending_expiry_test.go (5 tests incl. Resolve contract)
• internal/memory + internal/memory/extended green under -race; full cmd/odek green under -race (×2)
• golangci-lint clean locally
• 3 adversarial judges; all findings fixed