fix(proposal-a): session_end hook clean composite keys to prevent memory leak

When config.autoCapture === false, the auto-capture session_end (priority 10)
was skipped, leaving only the Phase 1 session_end (priority 20) to clean up.
The old code only deleted pendingRecall[sessionKey] - a simple key - but not
composite keys (sessionKey:agentId). Now uses pattern matching (startsWith)
to clean all related keys regardless of format.

Fixes: P1 issue from Phase 1 audit

Author: jlin53882

index.ts

@@ -3206,9 +3206,20 @@ const memoryLanceDBProPlugin = {
     // Proposal A Phase 1: session_end hook - Clean up pending recalls
     // ========================================================================
     api.on("session_end", (_event: any, ctx: any) => {
-      const sessionKey = ctx?.sessionKey || ctx?.sessionId || "default";
-      if (sessionKey) {
-        pendingRecall.delete(sessionKey);
+      // P1 fix: clean all pendingRecall entries for this session, including composite keys.
+      // When autoCapture is false, the auto-capture session_end (priority 10) is skipped,
+      // so this hook must handle composite keys (sessionKey:agentId) as well.
+      const sessionId = ctx?.sessionId || "";
+      const sessionKey = ctx?.sessionKey || "";
+      for (const key of pendingRecall.keys()) {
+        if (
+          key === sessionKey ||
+          key === sessionId ||
+          key.startsWith(`${sessionKey}:`) ||
+          key.startsWith(`${sessionId}:`)
+        ) {
+          pendingRecall.delete(key);
+        }
       }
     }, { priority: 20 });