memoryd: refuse and flag memory writes through bxcore::sanitize

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/memoryd/src/review.rs

@@ -207,7 +207,7 @@ pub fn reject(store: &Store, id: &str, now: Timestamp) -> Result<String, String>
     // 1. The Waiting line with this id, else Err(format!("nothing waiting as {id}")).
     // 2. `add` a Rejected line { id, time now }.
     // 3. `journal::append` a Record: its session and call, action "reject", file None, to empty, no
-    //    entries, no notes, untrusted false, undoes Some(id).
+    //    entries, no notes, untrusted false, flag None, undoes Some(id).
     // 4. Ok(format!("rejected: {id}")).
     let waiting_lines = waiting(store)?;
     let found = waiting_lines
@@ -244,6 +244,7 @@ pub fn reject(store: &Store, id: &str, now: Timestamp) -> Result<String, String>
             after: Vec::new(),
             notes: Vec::new(),
             untrusted: false,
+            flag: None,
             undoes: Some(id.to_string()),
         },
         now,