fix(portability): validate envelope contents before importing (#2)

[rksharma-owg]

• Add Zod validation schemas for exported memories, aliases, and envelopes
• Validate envelope structure in validateExportEnvelope before inserting rows
• Surface descriptive error messages identifying invalid fields
• Add unit tests for malformed and missing envelope fields

What & why

Related issue

Closes #

How was it tested?

Checklist

• npm run ci passes locally (typecheck + tests + build + smoke)
• Added or updated tests for this change
• The change is focused on one concern (no unrelated refactors/reformatting)
• For schema changes: added a new migration in src/db/migrate.ts (never edited a shipped one)
• For retrieval/search changes: ran npm run bench and included the before/after numbers below

[vercel]

@rksharma-owg is attempting to deploy a commit to the vignesh's projects Team on Vercel.

A member of the Team first needs to authorize it.

[7vignesh]

Nice work @rksharma-owg - the zod schemas and path-specific errors are exactly what #2 needed.

Issue: this and your #19 both rewrite importMemories with conflicting behavior (reject-whole-file vs skip-bad-rows). For a local-first tool we'd rather skip-and-report, so we're building on #19. But your validation here shouldn't be lost - I've asked on #19 if you'd fold this PR's per-row zod validation into that one, counting a failed row instead of aborting.

If that works, we'll close this as superseded once #19 carries the validation - your work lives on there.

[rksharma-owg]

Per-row Zod validation has been folded into #19 (using the skip-and-report model). This PR can be closed as superseded once #19 lands.

[7vignesh]

Superseded by #19 (now merged). Per the plan we discussed, the envelope validation and version enforcement from this PR were folded into #19, which also adds the skip-malformed-rows behavior - so #19 closes both #1 and #2 in one coherent change. Merging both would have conflicted since they rewrite the same importMemories function. Your validation work lives on in #19; thanks for building the combined PR. Closing this as superseded, not rejected.