feat(recall): optional Jev reranking for icm recall

[nilhemdot]

What

Opt-in remote reranking for icm recall, configured with:

[recall]
reranker = "jev:jev-latest"   # needs TYPESAFE_API_KEY

When set, icm recall over-fetches 3× limit candidates, scores them in one batched request against TypeSafe's Jev API, and keeps the top limit by relevance probability before graph expansion. Empty (the default) leaves recall unchanged.

This ports the Jev reranker from memsearch (zilliztech/memsearch, src/memsearch/jev_reranker.py) with the same prompt, criteria and response validation, so users moving from memsearch keep the same ranking behavior.

Design notes

• Opt-in, off by default. Enabling it sends the query and candidate memory text to api.typesafe.ai. This is documented in config/default.toml.
• Fails loudly. A missing key, HTTP error, timeout, or malformed response returns an error instead of silently falling back to unreranked results, matching memsearch.
• No leaks. Error messages never include the response body (it may quote memory text) or the API key.
• Strict validation. Answers d0..dN must be exactly present, type == "noul", numeric, and in [0, 1].
• Hook path untouched. The per-prompt recall_context hook never makes network calls, per CONTRIBUTING's "cheap per-prompt path" rule. Only the explicit icm recall CLI reranks.
• Existing HTTP client. Uses the ureq client already in icm-cli, so no new dependencies.

Testing

• cargo fmt --all --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace: all pass.
• 6 new unit tests in jev.rs:
  • request shape keeps full content
  • valid scores parse in order
  • invalid scores are rejected (null, bool, string, < 0, > 1)
  • missing, extra, or wrong-type answers are rejected
  • empty candidates need no key
  • config prefix parsing
• Live, against a real store:
  • Query: "how do I route claude through the proxy".
  • Hybrid top 3 had an irrelevant auto-extracted memory at fix: update README license from MIT to source-available #2.
  • With Jev, the relevant memories scored 0.92 and 0.75, and the irrelevant one dropped out.
  • The run took about 6 s end to end.
  • A missing key gives Set TYPESAFE_API_KEY to enable Jev reranking.
  • A bad key gives Jev reranking failed (HTTP 401).

Note: develop's Cargo.lock has pre-existing version drift (icm-cli 0.10.63 vs 0.10.65), so --locked builds fail on develop. I left it out of this PR.

🤖 Generated with Claude Code

[nilhemdot]

Added tests/jev_integration.rs (55f89bb): end-to-end tests that run the real icm binary against a fake Jev server on localhost. They use the same TcpListener pattern as http_api_integration.rs, so no new dependencies. To point at the fake server, I added one small override, ICM_JEV_ENDPOINT.

The tests cover:

• reorder and truncate by score
• 3× over-fetch, auth header and request shape
• a 500 response fails without leaking the key, response body or memory text
• a missing key fails explicitly
• icm hook prompt never contacts Jev

As a check, I disabled the rerank sort; the ordering test fails, so it catches that regression. Full gate passes: fmt, clippy -D warnings, and cargo test --workspace (822 passed, 0 failed).