feat: add empty retrieval diagnostics

[cafitac]

Summary

• add read-only agent-memory observations empty-diagnostics for high empty retrieval ratio dogfood triage
• group empty-heavy observations by surface, preferred scope, and status filter with ratios, sample observation IDs, observation windows, and next-step hints
• document the new operator workflow and update current handoff

Safety / privacy

• read-only report; no memory, relation, or observation mutation
• no raw query text, query previews, prompt content, or user messages in output
• local dogfood/operator telemetry only

Verification

• RED: focused test initially failed because empty-diagnostics was not a valid observations subcommand
• GREEN focused: TMPDIR=$PWD/.tmp-test uv run pytest tests/test_cli.py::test_python_module_cli_observations_empty_diagnostics_groups_empty_segments_without_raw_queries -q
• focused observations set: 4 passed
• full tests: TMPDIR=$PWD/.tmp-test uv run pytest tests/ -q -> 175 passed
• uv run python scripts/check_release_metadata.py
• uv run python scripts/smoke_release_readiness.py
• npm pack --dry-run
• git diff --check
• node --check bin/agent-memory.js
• local dogfood smoke: observations empty-diagnostics /Users/reddit/.agent-memory/memory.db --limit 200 --top 10 --high-empty-threshold 0.5 -> retrieval_empty_diagnostics True 38 13 0.3421
• static diff secret scan: finding_count=0

[cafitac]

Updated after CI exposed an unrelated order assumption in test_hermes_adapter on one runner. Root cause: the test asserted literal fact IDs even though the retrieval order can tie differently across SQLite/Python environments. The amended test now asserts adapter output follows packet.retrieval_trace order and still verifies all three created facts are included. Re-ran full local verification: focused 2 passed, full tests 175 passed, release metadata/readiness, npm dry-run, diff check, node check, secret scan finding_count=0.