fix(deepseek-plugin): first-turn recall, native activation, and cancel-safe recall (#7284, #7302)

Ports #7285 onto current main and adds a canDeliver() gate so a canceled recall does not mark undelivered memories as seen.

Refs #7284, #7302. Supersedes #7285.

integrations/deepseek-plugin/src/scoping.ts

@@ -1,5 +1,16 @@
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { isAbsolute } from "node:path";
+
 export {
   entityAddParams as resolveAddParams,
   entitySearchFilters as resolveSearchFilters,
 } from "../../agent-plugin-core/typescript/src/identity.ts";
 export type { EntityParams } from "../../agent-plugin-core/typescript/src/identity.ts";
+
+export function resolveWorkspaceId(cwd: string | undefined): string {
+  if (!cwd || !isAbsolute(cwd)) {
+    throw new Error("Workspace memory scope requires an absolute session workspace path.");
+  }
+  return `deepseek-workspace-${createHash("sha256").update(realpathSync(cwd)).digest("hex")}`;
+}