feat: subconscious streaming line render, memory-tool routing for journal/ledger, 1.0.0 + dep bumps

TUI — subconscious live stream:
- Add `subconscious_stream: Vec<String>` to `ChatState`; events.rs already
  pushes here via `SubconsciousToken`/`SubconsciousToolCall`/`SubconsciousToolResult`.
- Render below the phase bar during `TurnPhase::Subconscious`. Newest at
  bottom in `palette.surfacing`; older lines fade upward toward
  `palette.agent_dim` via `lerp_color`; the oldest visible line gets the
  `DIM` modifier on top. Render path now builds `Vec<Line>` instead of
  collapsing into `Line::from(spans)` (the latter forced everything onto
  one horizontal row, which was the visible "1 2 3 across" bug). Lines
  are width-clipped with an ellipsis fallback.

Seeds — journal/ledger routing:
- Aster mandate Phase 3 now records journal entries via the `memory`
  tool at `journal/YYYY/MM/DD.md` (relative to memory root), never via
  `write`/`edit`. Previous phrasing read as a filesystem path and the
  model resolved it against cwd — when souveraine runs from the project
  tree that landed `journal/` and `memory/ledger/` directly in the
  source tree instead of the agent's memfs.
- "How I record" section likewise anchors ledger reads/writes to the
  `memory` tool's `append`/`read`/`write` commands.

Cargo:
- 0.1.0 → 1.0.0.
- tower-http 0.5 → 0.6, notify 6 → 7, crossterm 0.27 → 0.28.

Bug docs (`docs/bugs.md`):
- B-012: TUI doesn't auto-refresh after tool calls complete (event
  pipeline missing a redraw kick after `BackendEvent::ToolResult`).
- B-013: Tool calls stop working mid-conversation — model returns
  `tool_calls=0` for the rest of the session, no error or log.
  Suspected: recent `defs.rs` env-var refactor changing `retain`
  behavior on env vars, possibly nuking tool defs during schema gen.
- B-014: Subagent `run_in_background: true` blocks primary — the flag
  is parsed but never read; `Subagent::execute` unconditionally awaits;
  `SubagentPool` is a stub.

Task queue:
- Split old `live-subconscious-stream.md` into two scoped task files:
  `subconscious-live-reasoning-stream.md` (broader design — ticker,
  cockpit event log, agency-driven surfacing) and
  `subconscious-streaming-line-render.md` (this PR's narrow render
  wiring).
- New tasks: `prompt-override-system.md` (move hardcoded seeds into a
  project `prompts/` truth source the agent can override via
  `souveraine_operations/`), `pasted-content-formatting.md` (visual
  marker for pasted vs composed text).
- `CLAUDE.md` high-impact bullet: replace stale `rename-aster-to-subconscious`
  with `mid-turn-subconscious-checkpoint.md` (matches the c1f851f redesign
  that ripped out the watchdog in favour of `halt`/`intrusive` tools).

Public-branch prep:
- `docs/audit/external-security-audit-prompt.md` — scoped prompt for an
  external creds/PII/license sweep of the `public` branch.
- `commit-history-public.txt` — full public-branch log dump used as
  reference for that audit pass.

Cargo.lock

@@ -1785,15 +1785,15 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crossterm"
-version = "0.27.0"
+version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f476fe445d41c9e991fd07515a6f463074b782242ccf4a5b7b1d1012e70824df"
+checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
 dependencies = [
  "bitflags 2.11.1",
  "crossterm_winapi",
- "libc",
- "mio 0.8.11",
+ "mio",
  "parking_lot",
+ "rustix 0.38.44",
  "signal-hook",
  "signal-hook-mio",
  "winapi",
@@ -1809,7 +1809,7 @@ dependencies = [
  "crossterm_winapi",
  "derive_more",
  "document-features",
- "mio 1.2.0",
+ "mio",
  "parking_lot",
  "rustix 1.1.4",
  "signal-hook",
@@ -4121,9 +4121,9 @@ dependencies = [
 
 [[package]]
 name = "inotify"
-version = "0.9.6"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+checksum = "fdd168d97690d0b8c412d6b6c10360277f4d7ee495c5d0d5d5fe0854923255cc"
 dependencies = [
  "bitflags 1.3.2",
  "inotify-sys",
@@ -4162,6 +4162,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "interpolate_name"
 version = "0.2.4"
@@ -5177,18 +5186,6 @@ dependencies = [
  "simd-adler32",
 ]
 
-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "mio"
 version = "1.2.0"
@@ -5383,21 +5380,30 @@ checksum = "0676bb32a98c1a483ce53e500a81ad9c3d5b3f7c920c28c24e9cb0980d0b5bc8"
 
 [[package]]
 name = "notify"
-version = "6.1.1"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+checksum = "c533b4c39709f9ba5005d8002048266593c1cfaf3c5f0739d5b8ab0c6c504009"
 dependencies = [
  "bitflags 2.11.1",
- "crossbeam-channel",
  "filetime",
  "fsevent-sys",
  "inotify",
  "kqueue",
  "libc",
  "log",
- "mio 0.8.11",
+ "mio",
+ "notify-types",
  "walkdir",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "notify-types"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585d3cb5e12e01aed9e8a1f70d5c6b5e86fe2a6e48fc8cd0b3e0b8df6f6eb174"
+dependencies = [
+ "instant",
 ]
 
 [[package]]
@@ -7172,7 +7178,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-util",
  "tower 0.5.3",
- "tower-http 0.6.9",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -7214,7 +7220,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-util",
  "tower 0.5.3",
- "tower-http 0.6.9",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -8208,8 +8214,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
 dependencies = [
  "libc",
- "mio 0.8.11",
- "mio 1.2.0",
+ "mio",
  "signal-hook",
 ]
 
@@ -8366,7 +8371,7 @@ dependencies = [
 
 [[package]]
 name = "souveraine"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "anyhow",
  "arboard",
@@ -8380,7 +8385,7 @@ dependencies = [
  "cowsay",
  "cpal",
  "cron",
- "crossterm 0.27.0",
+ "crossterm 0.28.1",
  "dashmap 5.5.3",
  "dirs 5.0.1",
  "dotenvy",
@@ -8424,7 +8429,7 @@ dependencies = [
  "tokio-util",
  "toml 0.8.2",
  "tower 0.4.13",
- "tower-http 0.5.2",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
  "tui-big-text",
@@ -9671,7 +9676,7 @@ checksum = "110a78583f19d5cdb2c5ccf321d1290344e71313c6c37d43520d386027d18386"
 dependencies = [
  "bytes",
  "libc",
- "mio 1.2.0",
+ "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
@@ -9906,31 +9911,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "tower-http"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
-dependencies = [
- "bitflags 2.11.1",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "http-range-header",
- "httpdate",
- "mime",
- "mime_guess",
- "percent-encoding",
- "pin-project-lite",
- "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "tower-http"
 version = "0.6.9"
@@ -9945,12 +9925,18 @@ dependencies = [
  "http",
  "http-body",
  "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
  "pin-project-lite",
  "tokio",
  "tokio-util",
  "tower 0.5.3",
  "tower-layer",
  "tower-service",
+ "tracing",
  "url",
 ]