feat(memory): add permission aware retrieval

docs/memory-graph-runtime.md

@@ -22,6 +22,10 @@ with `markitect-tool`.
   tests and future service wiring.
 - `MemoryRuntimeService.import_markitect_graph()` persists an imported graph and
   can attach an audit event when an `OperationContext` is supplied.
+- `MemoryRuntimeService.query_memory()` retrieves graph nodes through a scope
+  policy check plus per-node policy checks, returns source-grounded context
+  items, preserves safe denied diagnostics, and emits an audit event in the
+  result envelope.
 
 ## Boundary