Audit of the 7b27608 chunker fix found that mid-line drawers
appeared on post-commit production data at 40% rather than the
claimed 0%. Root cause: 96% of bad post-commit drawers came from a
single tool-results .txt file under .claude/projects/, where Claude
Code spills oversized tool outputs. That file contained a Python
traceback with embedded Claude Code session JSONL inlined as the
"filename" of an OSError. normalize() returned it verbatim because
none of the JSON parsers extracted messages, then chunk_exchanges
fell through to paragraph-mode and smart_split hard-cut at ceiling
because the JSON blob has no natural-language boundaries.

Two-layer fix:

(1) Source-set hygiene — palace.SKIP_DIRS gains "tool-results".
    Claude Code per-session tool-results subdirectories contain raw
    tool artifacts (JSON dumps, log captures, error tracebacks with
    inlined session metadata), not conversation content. Skipping
    the subtree at the walker level prevents the failure mode at
    the source.

(2) Defense-in-depth — chunker.is_excluded_content gains JSON-blob
    detection. Two new heuristics:
    - >=50% of non-empty lines start with `{"key":` (the canonical
      JSONL session-log shape)
    - High `,"key":` density (>=1 per 200 chars) combined with a
      transcript marker (uuid/sessionId/requestId/messageId/
      parentUuid/timestamp:YYYY-) is decisive
    Real prose mentioning a uuid or showing one inline JSON example
    survives — only blob-level density triggers exclusion.

Also: convo_miner._emit_chunks and miner.chunk_text now apply
is_excluded_content per-chunk in addition to the whole-content
check. A largely-prose response with one embedded log/JSON
paragraph drops just that chunk rather than the whole exchange.

Validation against real production sources:
- tool-results/b5k5gj8gj.txt (the actual 82-bad-drawer culprit):
  whole-file excluded, 0 chunks produced (was 82 mid-line drawers)
- real Claude Code .jsonl session: 79K -> 13K transcript via
  normalize, 11 prose chunks, 0% length-cliff @800
- prose with inline JSON example: kept as one clean chunk

Tests: 997 pass (was 991), +5 chunker exclusion cases, +1 walker
skip-dir case. Forward-only — existing 95K drawers untouched. The
82 noise drawers from the b5k5gj8gj.txt artifact remain in the
palace pending a separate selective-delete decision.

Adds a clean public API for reading an agent's diary entries from the
palace, encapsulating the chromadb where-filter + sort + slice logic
that consumers (Vestige's runtime_orientation, primarily) were
inlining via mempalace.palace.get_collection.

Surface:

  - DiaryEntry dataclass (frozen): date, filed_at, topic, content.
    Mirrors the persistence shape used by tool_diary_write /
    tool_diary_read in mcp_server.

  - DiaryUnavailable exception: raised when the palace is unreachable
    or the diary collection cannot be queried. Distinguishes
    infrastructure failure (palace missing, chromadb error) from a
    genuinely empty diary (returns []). Callers who care can render
    differently: DiaryUnavailable -> "(diary unavailable)", [] ->
    "(no entries yet)".

  - read_diary(agent, last_n=5, *, palace_path=None) -> list[DiaryEntry]:
    Filters wing=wing_{agent.lower()} room=diary, sorts by filed_at
    descending, slices to last_n.

Side-effect-free: uses palace.get_collection (not mcp_server, which
performs dup2(stderr, stdout) at import time as part of the MCP stdio
protocol contract and would clobber consumer log streams).

Consumer migration: Vestige's runtime_orientation moves from inline
chromadb logic to this API in a coordinated PR. The TODO at
runtime_orientation.py:196 was the load-bearing comment that named
this exact API; that comment goes away in the consumer migration.

Tests: 10 new in tests/test_read_diary.py covering happy-path sort/
last_n/empty/wing-filter/case-insensitive-agent, plus DiaryUnavailable
raised on get_collection failure + col.get failure, plus palace_path
override semantics.

10/10 pass. No regression to existing layers tests.