Enforce mandatory HED tag validation before display

[neuromechanist]

Summary

• Strengthen system prompt to make HED tag validation mandatory (not "when in doubt")
• Make suggest_hed_tags return a visible error when CLI is unavailable instead of silent empty lists
• Remove "use docs instead" escape hatch from validate_hed_string error messages, replacing with explicit instruction to not present unvalidated tags

Fixes #210

Test plan

• All existing HED tests pass (uv run pytest tests/ -v -k "hed")
• Community/config tests pass (496 passed)
• Ruff lint/format passes
• Deploy to dev and test with the original query: "How can I annotate muscle artifacts for EEG data?"
• Verify the assistant calls validate_hed_string before presenting tags
• Verify that when validation fails, the assistant tells the user instead of hallucinating

[neuromechanist]

PR Review Summary

Ran code-reviewer, silent-failure-hunter, comment-analyzer, and code-simplifier.

Issues Found and Fixed

Critical (2) - Fixed in d57b1ca:

1. suggest_hed_tags CLI execution errors (non-zero exit, timeout, bad JSON, generic exception) returned silent empty lists without "error" key - same pattern this PR aims to fix. Now all failure paths return visible errors.
2. validate_hed_string docstring still had old "use known-good example from docs" escape hatch. Updated to match new policy.

Important (2) - Fixed in d57b1ca:

1. validate_hed_string leaked raw exception text {e} in return dict. Sanitized to generic messages; full details still logged server-side.
2. Line 88 "never show the validation process" conflicted with "tell user when unavailable". Clarified: hide successful validation, be transparent about failures.

Suggestions (noted, not addressed):

• Example HED string in prompt (Sensory-event, Visual-presentation, Red) should be verified against HED 8.4.0 schema
• Section heading "Using Tools (MANDATORY)" slightly misleading since doc retrieval bullets are discretionary
• Validation mandate repeated in 5 places with slightly different wording

Strengths

• "What counts as needing validation" section explicitly closes LLM loopholes
• Error messages use direct imperative language appropriate for LLM agents
• Step 5 with literal example of what to say is effective for instruction-following

All review issues addressed. Tests pass (134 passed, 4 pre-existing async failures). Lint clean.