PR-C: Split user_preferences.json from heartbeat_config.json

[hanamorix]

Summary

Implements PR-C from the principle alignment audit at
docs/superpowers/audits/2026-04-25-principle-alignment-audit.md.

Introduces user_preferences.json as the single GUI-surfaceable cadence file.
heartbeat_config.json is now formally documented as developer-only internal
calibration — decay rates, GC thresholds, gating thresholds, reflex/research
enable flags. The GUI must never read or write that file.

Currently dream_every_hours is the only field in user_preferences.json,
matching the principle: the user picks how often the brain dreams; the brain
owns everything else.

Resolution order

In HeartbeatConfig.load():

1. heartbeat_config.json's value (or framework default 24.0)
2. user_preferences.json's value when the field is explicitly present

The "explicitly present" check (via read_raw_keys()) matters for back-compat:
a future user_preferences.json that adds a new field (e.g., growth_every_hours
once Phase 2a lands) must not silently shadow a custom dream_every_hours
sitting in heartbeat_config.json from before this split.

Changes

• brain/user_preferences.py — new UserPreferences dataclass with atomic
  load/save (.new + os.replace). Module-level read_raw_keys() helper that
  returns the explicit JSON keys, used by HeartbeatConfig.load to do per-field
  precedence rather than whole-object precedence.
• brain/engines/heartbeat.py — HeartbeatConfig.load() now merges
  user_preferences.json on top after loading heartbeat_config.json. Original
  load body extracted to _load_internal(). Updated docstring documents the
  two-file contract.

Test plan

• 11 new unit tests for UserPreferences + read_raw_keys (load/save,
  corrupt JSON, wrong-type fallback, atomic save)
• 5 new merge-precedence tests on HeartbeatConfig.load:
  override / fallback / present-but-omits-field / user-prefs-only / corrupt-prefs
• Full suite: 492 passed (was 476, +16 new)
• ruff check clean

Closes

This is the third and final cleanup PR from the principle alignment audit
(PR-A → PR-B → PR-C). After this lands, every routine user surface in the
framework matches the principle: name (persona dir) / cadence
(user_preferences.json) / face-body (out of scope until GUI work) /
generated documents (read-only inspection).