fix: enforce non-bypassable ingestion score floors

[NeerajCodz]

Motivation

• The ingestion path trusted caller-supplied IngestMemoryRequest.policy thresholds, allowing untrusted clients to lower min_importance_score/min_confidence_score and bypass write-quality gates.
• A minimal server-side enforcement is needed so that client-supplied policy cannot reduce thresholds below an operator-approved baseline.

Description

• Add trusted server-side baseline constants MIN_IMPORTANCE_SCORE and MIN_CONFIDENCE_SCORE in src/runtime/ingestion.rs to define non-bypassable minimums.
• During validation, compute min_importance_score and min_confidence_score by clamping the request policy with .max(...) against the server floor before comparing incoming scores.
• Preserve stricter operator-configured policy values while preventing clients from lowering thresholds below the trusted floor, and otherwise keep existing ingestion logic and outputs unchanged.

Testing

• Ran the test suite with cargo test -q, which completed successfully with 11 tests passing and 0 failures.
• Built and exercised the ingestion logic in unit tests to confirm low-scoring requests are still rejected when below the enforced floors.

---

Codex Task