feat(memory): add permission aware retrieval

workplans/KONT-WP-0017-agentic-memory-graph-runtime.md

@@ -80,6 +80,12 @@ Primary files:
 - `src/kontextual_engine/services/memory_service.py`
 - `docs/memory-graph-runtime.md`
 
+The permission-aware retrieval slice is also implemented in
+`MemoryRuntimeService.query_memory()`. It performs a scope policy check,
+per-node policy checks, returns source-grounded context items, preserves denied
+diagnostics without leaking denied node text, and emits an audit event in the
+result envelope.
+
 ## P17.1 - Import and map Markitect memory contracts
 
 ```task
@@ -130,7 +136,7 @@ tests.
 
 ```task
 id: KONT-WP-0017-T003
-status: todo
+status: done
 priority: high
 state_hub_task_id: "711b945e-19e6-4548-8ddb-6c2c364148ca"
 ```