brokerd: memory calls to memoryd with the session's state; labels only stricter

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/brokerd/src/container.rs

@@ -34,6 +34,9 @@ pub const EGRESS_POLL: Duration = Duration::from_millis(20);
 /// A log sink. Call it as `(self.log)("a line")`.
 pub type Log = Arc<dyn Fn(&str) + Send + Sync>;
 
+/// A memory tool that reached the container runtime: fixed, it reaches the model.
+pub const IN_MEMORYD: &str = "the memory tools run in memoryd, not in a container";
+
 pub struct Podman {
     runner: Runner,
     egress_dir: PathBuf,
@@ -240,6 +243,10 @@ impl Runtime for Podman {
     /// an egress starts the proxy first and gives the tool the directory. `run_container` is step 3
     /// to 7 for either. Already written.
     fn run(&self, spec: &RunSpec) -> Result<RunOutput, RunError> {
+        // `Routed` sends the memory tools to `memoryd`; one here is refused, never run.
+        if spec.tool().is_memory() {
+            return Err(RunError::Unavailable(IN_MEMORYD.to_string()));
+        }
         let n = self.next.fetch_add(1, Ordering::SeqCst);
         let name = podman::container_name(spec.session(), spec.call(), n);
         let input = spec.arguments().canonical_json();