fix(feeders): make post-mine repair opt-in, not default

The three feeder wrappers (mempalace-docs, mempalace-pi-session,
mempalace-session) unconditionally ran 'mempalace repair --yes' after
mining, controllable only via --no-repair opt-out. The contrib launchd
and systemd templates did not pass --no-repair, so every scheduled tick
invoked the destructive in-place HNSW rebuild.

This has bitten us twice:
  - 2026-05-04 09:08: a kickstart triggered repair while an MCP
    subprocess held the DB open; the live collection was wiped (0
    drawers) and had to be restored from the palace.backup snapshot.
  - 2026-05-05 10:00: post-mine repair crashed mid-rebuild with
    'NotFoundError: Collection [<uuid>] does not exist' - chromadb's
    rebuild recreated the collection under a new UUID while the code
    still held the old handle. Live DB survived only by luck (crash
    hit before the swap).

Fix: flip the default.
  - New flag: --repair (opt-in). Prints a warning and sleeps 3s before
    invoking 'mempalace repair --yes'.
  - --no-repair is retained as a deprecated no-op alias for backward
    compatibility with any scripts/units still passing it.
  - Default behavior: no repair. Routine ChromaDB add() keeps HNSW
    consistent; repair is a recovery op, not a maintenance tick.

Docs updated to match: README, SKILL, ARCHITECTURE, AGENTS,
contrib/README. Scheduling guidance now explicitly warns against
enabling --repair on cron/launchd/systemd-timer runs.

README.md

@@ -320,7 +320,7 @@ mempalace-docs <directory>                     # mine with wing = dirname
 mempalace-docs <directory> --wing my_project   # override wing name
 mempalace-docs <directory> --agent alice       # record agent on drawers
 mempalace-docs <directory> --dry-run           # list files, don't file
-mempalace-docs <directory> --no-repair         # skip post-mine repair
+mempalace-docs <directory> --repair            # opt-in post-mine repair (risky, interactive only)
 mempalace-docs --help
 ```
 
@@ -344,7 +344,7 @@ mempalace-session --since 2026-04-01              # only sessions updated on/aft
 mempalace-session --min-messages 6                # stricter short-session filter
 mempalace-session --db /custom/path/opencode.db   # non-default DB location
 mempalace-session --dry-run                       # export + list, skip mine
-mempalace-session --no-repair                     # skip post-mine index repair
+mempalace-session --repair                        # opt-in post-mine repair (risky, interactive only)
 mempalace-session --help
 ```