Property distributions for band filters

Per-namespace percentiles (p25/p50/p75, min/max) for each band property, plus available, calibrated, and the shipped default_cut. This is what a band chip compiles its recall properties bounds from. Omit ns for the whole workspace; pass it for one namespace — the upstream op is a SCAN over every property value in scope.

CACHED per (workspace, namespace, credential namespace ceiling). cache.hit is true when the answer came from the cache and no upstream call — and therefore no billing — occurred; cache.ttl_ms is the staleness bound, because Kairos exposes no way to read corpus_version more cheaply than the scan that returns it.

READ BEFORE BUILDING A CHIP: available: false means the property must not be offered at all. calibrated: false means p25/p75 are not trustworthy — use default_cut, and if that is also calibrated: false, decline to draw the band rather than draw a wrong one. default_cut: null (with a default_cut_reason) and an ABSENT default_cut are different answers: null means this band property deliberately ships no fallback (today spatial_spread), absent means it is not a band property. Record the RESOLVED FLOATS whenever a recall is saved or replayed, never the band name — the name is a function of a corpus that moves.

Requires the memories:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:read — every key minted before scoping keeps working here.