feat: Rust CLI — watch subcommand + agent event contract (LEO-336)

Add the `watch` subcommand: the agent wake-up primitive that evaluates
declarative `[[rules]]` against live or replayed samples and emits a
frozen, compact JSON event contract.

- One-shot mode: block until the first rule fires → one JSON event on stdout,
  optional atomic spool file, exit 10; timeout/replay-exhaustion → exit 0.
- Follow mode: log sensors like `log` while appending fired AND cleared events
  to daily events_*.jsonl, reusing the rotation/retention machinery.
- Monotonic, crash-safe seq persisted to <log_dir>/watch.seq (the integrity
  anchor); schema-versioned ~1 KB events; --rule / --min-severity filters.
- CLI-wide exit-code contract fixed here (0/1/2/10/130); Ctrl-C → 130 for
  watch only (log keeps 0); --spool-dir is flag-only.
- docs/agent-monitoring.md: five-layer architecture + event contract, with the
  autonomous-PR-review generalization (LEO-257). README/ROADMAP/skill in lockstep.
- Integration-tested on Linux via replay fixtures (event JSON, spool, exit codes);
  no new dependencies; MSRV 1.82.

Reviewed over four fix rounds (claude/codex/kimi/copilot); all reviewers LGTM,
all threads resolved. Fixes landed during review: --timeout inert with --replay,
unreadable-config → exit 1, SeqStore u64::MAX overflow guard, per-tick wall-clock
in follow, and exit-contract doc accuracy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>