fix: clear scorecard warnings for 0.4.9

[rogerdigital]

Summary

• clear Obsidian Community Scorecard risks and warnings by replacing unsafe Notebook Navigator integration typing with explicit interfaces and guards
• remove unsafe TFile casts, Buffer usage, and document focus access flagged by the scanner
• bump release metadata to 0.4.9 and add the Scorecard lint command to CI

Root cause

The latest release still contained a small amount of untyped third-party integration code and browser/global assumptions. Obsidian Community's Scorecard scanner surfaced those as unsafe TypeScript access, disallowed explicit any usage, an undescribed eslint directive, a TFile cast, and activeDocument compatibility warnings.

Test plan

• npm run lint:obsidian-warnings
• npm run build
• npm test
• git diff --check