Add attribute governance design: controlled attribute lists, egress regex selection, ingest signature validation

Defines the SA-V3-Ext/Int placeholder attribute scheme (external list
owned by the S3 handover spec, internal list for SA routing + internal
S3 usage), the per-egress Regex property for packing/signing selection,
the inverse-regex delete step at true external egress, optional
ingest-time signing with mandatory validation when already signed, and
the S3 JSON-fallback size attribute for suffix-range trailer reads.

.claude/memory/MEMORY.md

@@ -3,4 +3,5 @@
 - [Project Purpose](project-purpose.md) — why this repo exists, the two core problems being solved
 - [SA/MR Topology](topology.md) — deployment topology terminology and shape
 - [Packaging & Signing Design Decisions](packaging-signing-decisions.md) — key architecture calls and why
+- [Attribute Governance](attribute-governance.md) — controlled external/internal attribute lists, import/export filtering, dynamic hash algorithm
 - [Open External Dependencies](open-external-dependencies.md) — things this design assumes but doesn't own