Part of #1195 — Phase 4

Prevent persisting content flagged as containing injection patterns into long-term memory without user confirmation.

Crates: zeph-memory
Depends on: SEC-1.2

Tasks:

• Before SemanticMemory::store(): run content through ContentSanitizer injection detection
• If injection patterns detected: log warning, skip auto-store, require user confirmation
• Config: [security.exfiltration_guard] guard_memory_writes = true
• Unit tests: store clean content (passes), store injected content (blocked)

Files: crates/zeph-memory/src/orchestrator.rs