fix: address PR review — day sort, path canonicalization, dead code cleanup

- Sort within-day observations chronologically (was specificity-ordered)
- Canonicalize relative paths to POSIX format before DB lookup
- Skip projects param when allProjects is empty (prevents cross-project leaks)
- Remove dead stderrMessage field and hook-command block (unused after permissionDecision switch)
- Type permissionDecision as 'allow' | 'deny' union instead of string
- Remove redundant non-null assertions in getObservationsByFilePath
- Add edit guidance to deny message (use sed via Bash with smart tools)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/cli/types.ts

@@ -20,12 +20,11 @@ export interface HookResult {
   hookSpecificOutput?: {
     hookEventName: string;
     additionalContext: string;
-    permissionDecision?: string;
+    permissionDecision?: 'allow' | 'deny';
     permissionDecisionReason?: string;
   };
   systemMessage?: string;
   exitCode?: number;
-  stderrMessage?: string;  // Written to stderr before exit (for exit code 2 blocking feedback)
 }
 
 export interface PlatformAdapter {