release: v3.3.3 — restore install integrity

[bensig]

Draft — queued for @igorls review + approval before tagging.

Summary

Version bump commit for v3.3.3, a restore-integrity release. Unbreaks fresh `pip install mempalace` from v3.3.2.

No code changes in this PR — just three files:

• `pyproject.toml`: `3.3.2` → `3.3.3`
• `.claude-plugin/plugin.json`: `3.3.2` → `3.3.3`
• `CHANGELOG.md`: new `[3.3.3]` entry

The #1093 fix is already on `develop` via merged #340 (messelink, ~10h after we tagged 3.3.2).

Why

v3.3.2 shipped a `.claude-plugin/plugin.json` referencing a `mempalace-mcp` binary that the same release's `pyproject.toml` never declared. Every fresh `pip install mempalace==3.3.2` produces a Claude Code plugin config pointing at a binary that isn't installed → MCP server fails to launch. Diagnosed by @jphein in #1093.

What ships with 3.3.3 (all already on `develop`)

Bug fixes

• #340 — `mempalace-mcp` entry point (the v3.3.2 release defect: mempalace-mcp entry point missing from pyproject.toml despite plugin.json requiring it — MCP server fails to start on fresh install #1093 fix)
• #1021 — Claude Code 2.1.114 silent-save regression
• #851 — large-palace `status` pagination
• #942, #833 — hook resolution (Windows, plugin-dir)
• #659 — diary per-project wing-scoping (jphein)
• #1097 — `mempalace_search` empty-string filter

Improvements

• #673 — deterministic hook saves
• #661 — graph cache + write-invalidation

Added

• i18n: #1051, #1001, #945

Deferred to 3.3.4

• #976 (HNSW SIGSEGV / closes SIGSEGV in HNSW parallel inserts — missing hnsw:num_threads on collection creation #974) — conflicting, awaiting felipetruman rebase. Pinged tonight.

Smoke test — passed locally on develop @ HEAD (before this version bump)

```bash
$ grep mempalace-mcp pyproject.toml .claude-plugin/plugin.json
pyproject.toml:mempalace-mcp = "mempalace.mcp_server:main"
.claude-plugin/plugin.json: "command": "mempalace-mcp"

$ python -m build --wheel
Successfully built mempalace-3.3.2-py3-none-any.whl

$ python -m venv /tmp/v333 && source /tmp/v333/bin/activate
$ pip install dist/mempalace-3.3.2-py3-none-any.whl
$ which mempalace-mcp
/tmp/v333/bin/mempalace-mcp

$ mempalace-mcp --help
usage: mempalace-mcp [-h] [--palace PATH]
MemPalace MCP Server
...
```

All four invariants pass. Full brief with decisions + proposed release notes: see go-team-mempalace/proposals/v3-3-3-igor-brief.html.

Review checklist for @igorls

• Cut from current `develop` is the right shape (vs a narrower cherry-pick onto `release/3.3.3` branch)?
• Ship without #976 (recommend yes — unblocks install now; fix: HNSW graph corruption, PreCompact deadlock, mine fan-out (closes #974, #965, #955) #976 rolls to 3.3.4)?
• CHANGELOG entry complete and accurate?
• Release-checklist PR from @jphein (adding the `grep mempalace-mcp` invariant to `docs/RELEASING.md`) — pull into 3.3.3 if filed, or 3.3.4?

Tag sequence (after merge)

```bash
git checkout develop && git pull
git tag -a v3.3.3 -m "v3.3.3 — restore install integrity"
git push origin v3.3.3
```

CI publishes to PyPI; marketplace refresh picks up `plugin.json`.

---

Ready for your review. Mark as ready-for-review + merge (or redirect) when you're happy with the shape.

[bensig]

Closing in favor of a re-opened PR from a non-release/* branch — the release/* branch-protection ruleset blocks follow-up commits from my account (no bypass), so I can't push a CI fix to this branch. The initial commit here missed 3 of 5 version files (version.py, marketplace.json, codex-plugin/plugin.json) and test_version_py_matches_pyproject caught it. Superseded by #1144 (all 6 files bumped in one commit).