fix: address PR review — day sort, path canonicalization, dead code cleanup

- Sort within-day observations chronologically (was specificity-ordered)
- Canonicalize relative paths to POSIX format before DB lookup
- Skip projects param when allProjects is empty (prevents cross-project leaks)
- Remove dead stderrMessage field and hook-command block (unused after permissionDecision switch)
- Type permissionDecision as 'allow' | 'deny' union instead of string
- Remove redundant non-null assertions in getObservationsByFilePath
- Add edit guidance to deny message (use sed via Bash with smart tools)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/services/sqlite/observations/get.ts

@@ -122,8 +122,8 @@ export function getObservationsByFilePath(
   options?: { projects?: string[]; limit?: number }
 ): ObservationRecord[] {
   const rawLimit = options?.limit;
-  const limit = Number.isInteger(rawLimit) && rawLimit! > 0
-    ? Math.min(rawLimit!, 100)
+  const limit = Number.isInteger(rawLimit) && (rawLimit as number) > 0
+    ? Math.min(rawLimit as number, 100)
     : 15;
   const params: (string | number)[] = [filePath, filePath];