Title: Feature: Add retain_roles config to control which session types trigger memory retain

Body:

Problem

Currently, Hindsight auto_retain fires on every session type — including cron jobs and delegated subagent runs. This pollutes the memory bank with task-specific operational data (e.g., stock report outputs, cron job logs) that is not useful for long-term user context and wastes LLM extraction tokens.

Current Behavior

• _memory_nudge_interval is a global setting that applies to ALL sessions (CLI, gateway, cron)
• Cron sessions set HERMES_CRON_SESSION=1 but have no memory-specific gate
• Leaf subagents already skip retain (no memory tool), but the auto_retain in the Hindsight plugin still runs on cron sessions
• Background review correctly sets _memory_nudge_interval = 0, but this is hardcoded, not configurable

Proposed Solution

Add a retain_roles config option under memory in config.yaml that specifies which session types should trigger auto_retain:

memory:
  provider: hindsight
  nudge_interval: 10
  retain_roles:
    - user        # direct user conversations (CLI, gateway DMs)
    - gateway     # gateway-managed sessions
    # cron: false  # cron jobs excluded from retain
    # subagent: false  # delegated subagent runs excluded

Default should be ["user", "gateway"] to maintain current behavior for interactive sessions while excluding cron and subagents unless explicitly opted in.

Alternative Approaches

1. A simpler boolean: retain_cron: false — just exclude cron sessions
2. Use HERMES_CRON_SESSION env var to disable auto_retain at the plugin level
3. Per-cron-job config: allow retain: false in cron job definitions

Environment

• Hermes Agent v0.11.x
• Hindsight plugin (self-hosted)
• OS: OpenCloudOS 9.2