feat: add retrieval observation audit

[cafitac]

Summary

• add a read-only agent-memory observations audit CLI over local retrieval observations
• summarize surface/scope counts, empty retrievals, top injected memory refs, current memory status, and simple noisy/stale signals without emitting raw query text
• add a storage helper for current memory status lookup across facts/procedures/episodes
• document the audit flow in README, Hermes dogfood guide, and current handoff

Test plan

• RED: focused audit CLI regression failed before implementation because observations audit was not a valid subcommand
• uv run pytest tests/test_cli.py::test_python_module_cli_observations_audit_reports_frequent_and_stale_refs_without_raw_queries -q
• uv run pytest tests/test_cli.py::test_python_module_cli_observations_audit_reports_frequent_and_stale_refs_without_raw_queries tests/test_cli.py::test_python_module_cli_retrieve_observe_records_secret_safe_local_observation tests/test_cli.py::test_python_module_cli_observations_list_migrates_existing_database_without_observation_table -q
• uv run python -m agent_memory.api.cli observations audit --help
• uv run python -m agent_memory.api.cli observations list --help
• real temp-DB smoke: retrieve twice with secret-like query, deprecate injected fact, run observations audit, verify read-only JSON/signals and no raw secret-like strings
• uv run pytest tests/ -q → 169 passed
• uv run python scripts/check_release_metadata.py
• uv run python scripts/smoke_release_readiness.py
• npm pack --dry-run
• git diff --check
• node --check bin/agent-memory.js
• static diff secret scan → finding_count: 0