fix(memory): honor authorized canonical list pin

[Git-on-my-level]

Problem

GET /v1/dev/user/memories authorized and pinned canonical accounts correctly, but its MemoryService.read() call independently reran the stricter rollout/control read decision. When those decisions diverged, the canonical route silently read the legacy collection and returned HTTP 200 with a stale pre-cutover prefix. The MCP list routes had the same double-routing boundary.

Fix

• Add a narrow MemoryService.read_pinned() seam that reads the backend already selected by an authorized external list route.
• Use that seam for Developer API, MCP REST, and MCP SSE canonical list reads.
• Preserve the existing default-read grant ordering, canonical visibility filtering, public response projection, and legacy behavior for legacy-pinned accounts.
• Add a behavioral Developer API regression with old- and new-schema canonical rows, including predicate, subject attribution, evidence, veracity, and uncertainty fields. It proves the current row remains visible while raw provenance fields stay outside the Developer response.

PR #10646 changes legacy search and mutation/vector boundaries in memory_service.py; this PR does not overlap those hunks or duplicate its behavior.

Product invariants affected

• INV-MEM-1

Failure-Class: none

This is an isolated double-routing defect rather than an instance of a registered semantic failure class. The prevention artifact is the Developer route regression at backend/tests/unit/test_dev_api_canonical_grant_ordering.py::test_get_memories_uses_authorized_canonical_pin_for_new_schema_rows, backed by the explicit pinned-read service seam.

Verification

• Prove-fail: with the Developer route restored to MemoryService.read(), the new regression returned only canonical-old-schema and failed because canonical-new-schema was absent.
• backend/.venv/bin/python -m pytest -q backend/tests/unit/test_dev_api_canonical_grant_ordering.py backend/tests/unit/test_dev_api_memories_pagination.py backend/tests/unit/test_mcp_data_endpoints.py backend/tests/unit/test_ws_l_surface_routing.py backend/tests/unit/test_memory_service_parity.py — 82 passed.
• Diff-selected backend/test.sh lane — all 38 selected unit-test files passed.
• Pyright on the four changed production modules with the pinned Python 3.11 environment — 0 errors, 0 warnings.
• Black 24.4.2 check on all six changed Python files — clean.
• make preflight — passed after the final commit.

Closes SCA-185