fix: security & integration hardening + unified CI workflow

## Code Changes (from original PR #16)

Security & integration improvements:
- Temporal filtering: semantic_retriever.rs (fact_invalid_at, event_time)
- Answer validation: query_router.rs (6-signal multi-signal validation)
- GRM context → facts: fact_extractor.rs + ingest_pipeline.rs
- Speaker extraction first: entity_extractor.rs (Zep alignment)
- Memorability gate: memorability_gate.rs
- Community metrics: community_metrics.rs
- Answer validator: answer_validator.rs

## CI Workflow (unified pattern from main)

Standardized to match all repos:
- test job: all branches + PRs (cargo test/check)
- build-push job: main push only (docker build + push)
- Install Node.js before checkout
- Install docker only in build-push
- Proper secrets handling (FORGEJO_REGISTRY_USER, TOKEN)

README.md

@@ -99,4 +99,3 @@ See `config/default.toml` for:
 6. Document in API.md
 
 See `CLAUDE.md` for project context and constraints.
-# CI test 1788759975