fix: harden error handling, fix TOCTOU races, and improve test accuracy

Core library fixes:
- session-manager.js: wrap all statSync calls in try-catch to prevent
  TOCTOU crashes when files are deleted between readdir and stat
- session-manager.js: use birthtime||ctime fallback for Linux compat
- session-manager.js: remove redundant existsSync before readFile
- utils.js: fix findFiles TOCTOU race on statSync inside readdir loop

Hook improvements:
- Add 1MB stdin buffer limits to all PostToolUse hooks to prevent
  unbounded memory growth from large payloads
- suggest-compact.js: use fd-based atomic read+write for counter file
  to reduce race window between concurrent invocations
- session-end.js: log when transcript file is missing, check
  replaceInFile return value for failed timestamp updates
- start-observer.sh: log claude CLI failures instead of silently
  swallowing them, check observations file exists before analysis

Test fixes:
- Fix blocking hook tests to send matching input (dev server command)
  and expect correct exit code 2 instead of 1

scripts/hooks/post-edit-format.js

@@ -11,10 +11,13 @@
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 
+const MAX_STDIN = 1024 * 1024; // 1MB limit
 let data = '';
 
 process.stdin.on('data', chunk => {
-  data += chunk;
+  if (data.length < MAX_STDIN) {
+    data += chunk;
+  }
 });
 
 process.stdin.on('end', () => {