fix(ids): watching nothing is not the same as having no baseline

`simon ids` without `--watch` reported, on every run: "files: no baseline —
0 recorded now. no baseline existed, so nothing could be compared; one has
now been recorded." The next run said it again, which contradicts it — if
one had been recorded, the next run would find it. Recording nothing is not
recording a baseline.

Both cases are an empty map, and `baseline.is_empty()` cannot tell them
apart. An empty watchlist now says so, and says how to fix it, and does not
claim a recording that did not happen.

The second reason to separate them matters more than the wording. This is an
intrusion detector, and its first-run caveat — "a baseline taken after an
intrusion records the intrusion; this run is not evidence that the machine
is clean" — is the most important line it prints. Printing it unchanged on
every run forever is how a reader learns to skip it, and then it is not
there when it counts. It now appears only when a first run over a real
watchlist has actually happened.

The socket half was already correct and is untouched: it recorded 95
listeners, then on the next run reported a new UDP listener and a departed
one, each with certainty and whether the port is routable.

Verified end to end rather than by reading: a watched file goes no-baseline,
then clean, then `[High/Certain] file.modified` with both hashes and both
sizes. Two regression tests cover the split — that watching nothing claims
no recording and points at `--watch`, and that a genuine first run still
carries the caveat.

Feature isolation checked this time, after `7c79f8b`: none, cpu and cli all
build. fmt, clippy, both cross-target checks, 11 ids::file unit tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>