fix(watchers): revive dead skill and memory file watchers

[rich7420]

Summary

chokidar v4+ dropped glob support, but two watchers still handed it literal glob
paths (skills/watcher.ts, memory/index.ts). In v5 a path containing * is
treated as a literal filename that matches nothing, so both watchers registered
successfully — returned a live FSWatcher, attached their .on("all") handler —
yet never fired. The failure was invisible: no log, no error.

This restores them by watching the containing directories (non-glob) and
filtering events in the handler, and hardens the ignore matching so legitimately
named skill/memory files are no longer pruned.

Before

• skills/watcher.ts watched ~/.hawky/skills/*/SKILL.md and
  <ws>/skills/*/SKILL.md. Both matched nothing → skill hot-reload was fully
  dead: editing/adding/removing a skill on disk had no effect until a full
  process restart.
• memory/index.ts watched <ws>/*.md (dead glob) plus <ws>/memory and the
  sessions dir (real dirs, worked). So editing a top-level .md such as
  HAWKY.md never triggered a memory reindex — the index silently drifted
  from the files it claims to mirror.
• The ignore list used unanchored substring regexes (/build/, /dist/,
  /node_modules/, …). Once a watcher is live, these prune any path containing
  the substring — e.g. a skill named prompt-builder (contains "build") would be
  silently skipped.

After

• Skills watcher watches the skill root directories and reacts only to files
  whose basename is SKILL.md, so edits, adds and removes propagate within one
  debounce window.
• Memory watcher watches the workspace root + sessions dir and filters changed
  paths to exactly what the indexer consumes (top-level .md, the memory/
  subtree, session .jsonl), so top-level .md edits now reindex.
• Ignore matching is now by exact path segment scoped below the watch roots,
  so prompt-builder (or even a skill named build) and a memory file like
  node_modules-notes.md are kept, while real vendored dirs inside a skill are
  still skipped.

Validation

• tsc --noEmit: clean.
• bun test ./tests/test-*.ts ./tests/test-*.tsx ./tests/unit/*.test.ts:
  4728 pass, 5 skip, 0 fail (235 files).
• New integration tests (real filesystem, not mocks):
  • skills watcher fires on a real SKILL.md, including prompt-builder /
    build-named skills, and stays quiet for a SKILL.md nested in a vendored
    node_modules/;
  • createMemoryWatcher fires on a top-level .md, filters non-targets, and no
    longer prunes node_modules-notes.md;
  • end-to-end through the real MemoryIndex: a root .md written after startup
    becomes searchable — the exact behavior this fix restores.

Limitations / Follow-ups

1. The memory watcher now watches the whole workspace root recursively
   (depth: 2) to catch top-level .md; fine for the default
   ~/.hawky/workspace, a minor cost for a large injected workspace.
2. makeIgnored and the path-prefix check are near-duplicated across
   skills/watcher.ts, memory/watcher.ts, and memory/index.ts — candidate
   for a shared isPathInside / makeSegmentIgnore helper.
3. The skills watcher still hardcodes ~/.hawky; unifying on the configured root
   is tracked separately as the HAWKY_HOME cleanup.