chore(release): publish Cortex 4.23.5 - #641

Release Cortex 4.23.5, a bug-fix release bundling three user-reported fixes (#633, #634, #636, all filed by the same Windows end user) and the Windows CI leg that now actually exercises them.

• Upgrade 3.x → 4.x leaves the plugin on PostgreSQL: backend.json is never written when setup.py fails #633: install-plugin.sh discarded a correctly-chosen SQLite backend whenever scripts/setup.py failed after it, forcing a hard PostgreSQL requirement on the next launch with nothing provisioned. The marker now persists before setup can fail, and a failed backend switch restores the prior working marker instead of leaving it pointing at an unconfirmed backend.
• SQLite backend runs without vector search: sqlite-vec is never installed into the plugin deps dir #634: neither the plugin launcher's dependency pins nor scripts/setup.py's install closure ever named the [sqlite] extra, so the zero-config SQLite default ran with vector search silently disabled on every install. Separately, a memory could be mislabelled as vector-backed when the vector never actually persisted. sqlite-vec now ships in the base install set, existing installs self-heal on next launch, and the embedding-model stamp is only ever 'neural' once the vector genuinely landed.
• consolidate on SQLite: four wiki passes fail on every run with 'SqliteMemoryStore' object has no attribute 'batch_pool', while status stays ok #636: four wiki maintenance passes crashed on every SQLite run (a PostgreSQL-only connection pool accessed unconditionally) while consolidate kept reporting overall success. The backend is now decided once, at the top of the maintenance cycle, and PostgreSQL-only passes are simply absent from the response on SQLite rather than silently broken.
• Windows CI leg: added the test files these three fixes actually changed to the curated Windows test list, and a new verifier that checks every package pyproject.toml's [sqlite] extra declares actually resolves under the real install path.

Every fix underwent an independent review pass; three of the four surfaced a real defect (a stamp-skip regression worse than the original bug, a backend-switch regression, and a contract test bypassing the real composition root), each corrected and re-verified with a fresh green CI run before merging.

Validation: 17 version-consistency checks (scripts/check_version_surfaces.py); full suite (8712 passed, 301 skipped — expected PostgreSQL-gated skips on this SQLite-only local run); Ruff lint and formatting; craftsmanship gate; doc-claims gate. The marketplace-pin check will be repeated once the version is tagged.

🤖 Generated with Claude Code