fix: harden CI validators, shell scripts, and expand test suite

- Add try-catch around readFileSync in validate-agents, validate-commands,
  validate-skills to handle TOCTOU races and file read errors
- Add validate-hooks.js and all test suites to package.json test script
  (was only running 4/5 validators and 0/4 test files)
- Fix shell variable injection in observe.sh: use os.environ instead of
  interpolating $timestamp/$OBSERVATIONS_FILE into Python string literals
- Fix $? always being 0 in start-observer.sh: capture exit code before
  conditional since `if !` inverts the status
- Add OLD_VERSION validation in release.sh and use pipe delimiter in sed
  to avoid issues with slash-containing values
- Add jq dependency check in evaluate-session.sh before parsing config
- Sync .cursor/ copies of all modified shell scripts

scripts/ci/validate-agents.js

@@ -40,7 +40,14 @@ function validateAgents() {
 
   for (const file of files) {
     const filePath = path.join(AGENTS_DIR, file);
-    const content = fs.readFileSync(filePath, 'utf-8');
+    let content;
+    try {
+      content = fs.readFileSync(filePath, 'utf-8');
+    } catch (err) {
+      console.error(`ERROR: ${file} - ${err.message}`);
+      hasErrors = true;
+      continue;
+    }
     const frontmatter = extractFrontmatter(content);
 
     if (!frontmatter) {

scripts/ci/validate-commands.js

@@ -19,7 +19,14 @@ function validateCommands() {
 
   for (const file of files) {
     const filePath = path.join(COMMANDS_DIR, file);
-    const content = fs.readFileSync(filePath, 'utf-8');
+    let content;
+    try {
+      content = fs.readFileSync(filePath, 'utf-8');
+    } catch (err) {
+      console.error(`ERROR: ${file} - ${err.message}`);
+      hasErrors = true;
+      continue;
+    }
 
     // Validate the file is non-empty readable markdown
     if (content.trim().length === 0) {

scripts/ci/validate-skills.js

@@ -27,7 +27,14 @@ function validateSkills() {
       continue;
     }
 
-    const content = fs.readFileSync(skillMd, 'utf-8');
+    let content;
+    try {
+      content = fs.readFileSync(skillMd, 'utf-8');
+    } catch (err) {
+      console.error(`ERROR: ${dir}/SKILL.md - ${err.message}`);
+      hasErrors = true;
+      continue;
+    }
     if (content.trim().length === 0) {
       console.error(`ERROR: ${dir}/SKILL.md - Empty file`);
       hasErrors = true;