feat: add safe managed Memory Bank blocks

[dapi]

Closes #37

Summary

• add a versioned managed routing block for AGENTS.md with an explicit alternative target
• make init/update idempotently create or update only the owned block and include its exact diff in dry-run/JSON reports
• add doctor checks for missing, outdated, and ambiguous markers
• preserve user-owned bytes outside standalone markers and reject damaged, duplicate, inline, or case-aliased unsafe targets
• read agent files through pinned repository handles and apply mutations atomically
• update adoption, CLI, and ownership documentation

Verification

• go test -count=1 -race ./...
• go vet ./...
• memory-bank lint
• git diff --check