fix(claude-code): resolve directoryBankMap by nearest ancestor

[r266-tech]

Summary

• make absolute directoryBankMap entries apply to descendant working directories
• choose the nearest configured ancestor when mappings are nested
• preserve exact matching for relative keys and existing symlink equivalence
• fail closed for ambiguous canonical aliases and prevent symlinked mappings from widening into unrelated descendant trees

This addresses the Claude Code routing failure reported in #2519: after the agent changes into a project subdirectory, retain/recall operations continue using the configured project bank instead of silently falling back.

The issue also notes Codex dynamic project IDs. I intentionally left that separate: changing Codex's existing directory-derived IDs requires an explicit migration/compatibility design for memories already stored under legacy subdirectory banks.

Verification

• PYTHONPATH=scripts .venv/bin/python -m pytest tests/test_bank.py -q — 58 passed
• focused Ruff check and format check
• generated docs-skill mirror regenerated and link validation passed
• git diff --check

Review notes

Adversarial review drove explicit coverage for nested roots, sibling-prefix boundaries, Windows drive/UNC behavior, symlink containment, canonical alias conflicts, order independence, and mutable-realpath snapshot consistency. Exact symlink equality and POSIX case semantics remain compatible with current behavior; the new lexical guard applies to descendant expansion.