security(knowledge): redact known fleet hostnames/IPs by exact match in claude_memory_importer #16655

Context

#16643 (importer for #16642) redacts secrets and generic internal-identifier shapes (private IPv4, .local/.internal/.corp/.lan/.intranet suffixed hostnames, ssh command targets) before storing Claude Code memory files as knowledge_facts. A disclosed, deliberately-not-closed gap remains: a bare internal hostname mentioned in plain prose with no ssh-command context and no recognized suffix (e.g. "the box is called prod-db-3") passes through untouched. Widening the shared a2a.pii_pipeline's hostname detector to catch arbitrary bare hostnames was rejected as a fix inside #16643 — any "any short word might be a hostname" heuristic is a false-positive machine, and that module has other consumers whose behavior shouldn't change for this feature's sake.

Proposed approach

Redact by exact, case-insensitive match against the fleet's known identifiers, not a shape heuristic: the hostnames/IPs already registered for this deployment (SLM node registry — autobot-slm-backend/services/inventory_builder.py / models/database.py looked like the right area on a first pass, not yet confirmed) plus any configured service hosts in SSOT config (autobot_shared/ssot_config.py). Since the set is finite and known at import time, this has zero false-positive risk on ordinary prose — unlike a generic hostname regex — and it's precisely the set of identifiers that would actually leak something meaningful about this deployment's infrastructure.

Acceptance Criteria

• Identify the canonical source(s) of known fleet hostnames/IPs for the running deployment (SLM node registry, SSOT config service hosts, or both)
• claude_memory_importer._redact() (or a helper it calls) redacts exact, case-insensitive matches of those identifiers before content reaches store_fact/update_fact
• Redaction is read fresh at import time (not baked in), so it stays accurate as the fleet changes
• Test: a memory file mentioning a registered hostname bare in ordinary prose (no ssh command, no recognized suffix) is redacted
• Test: ordinary prose that happens to contain a short word matching no registered identifier is left untouched (no new false positives)

Out of Scope

• Generic bare-hostname detection via regex/heuristic (rejected — false-positive prone, and belongs to a2a.pii_pipeline if ever done, not this importer)
• The read-path enforcement gap (security(kb): fact visibility is not enforced on the canonical read paths — knowledge_search and the grounded-agent RAG path never call check_access #16654) — unrelated concern

Discovered during the #16643 security review (round 2/3). Not a blocker for #16643 — the gap is already disclosed there; #16643 blocks on #16507/#16654 regardless.