add memory_remember and memory_recall tools; fix sandbox for pyenv

memory_remember: saves a denote-formatted flat file to $OLLIE_9MOUNT/m
memory_recall: searches memories by keyword/tag/title via grep

Both write/read through the 9P FUSE mount. Removed os.makedirs calls
that failed with ERANGE on the 9P-backed /m directory.

sandbox/restricted.yaml: add {HOME}/.pyenv, .rbenv, .nvm to rox so
python3 and other version-managed interpreters can execute.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sandbox/restricted.yaml

@@ -17,6 +17,9 @@ filesystem:
     - "{HOME}/.local/bin"
     - "{HOME}/opt"
     - "{PLAN9}/bin"
+    - "{HOME}/.pyenv"
+    - "{HOME}/.rbenv"
+    - "{HOME}/.nvm"
   rw:
     - "/dev/null"
     - "/tmp"

tools/memory_recall

@@ -6,7 +6,6 @@
 
 mount="${OLLIE_9MOUNT:-$HOME/mnt/ollie}"
 mem_dir="$mount/m"
-mkdir -p "$mem_dir"
 
 query="$*"
 

tools/memory_remember

@@ -17,7 +17,6 @@ body     = sys.argv[3]
 
 mount = os.environ.get("OLLIE_9MOUNT") or os.path.expanduser("~/mnt/ollie")
 mem_dir = os.path.join(mount, "m")
-os.makedirs(mem_dir, exist_ok=True)
 
 now   = datetime.now()
 ident = now.strftime("%Y%m%dT%H%M%S")
@@ -48,7 +47,11 @@ signature:
 {body}
 """
 
-with open(path, "w") as f:
-    f.write(content)
+try:
+    with open(path, "w") as f:
+        f.write(content)
+except OSError as e:
+    print(f"error: failed to write {path}: {e}")
+    sys.exit(1)
 
-print(filename)
+print(f"saved: {filename}")