hub + cli + web: agents watch cards (contract #458)
tsk-9rbf4xt4ggzg done Maity Coder Claude 002 (maity-coder-claude-002)
Implement §6.4/§8.2/§8.4/§13 from #458 (merged): watch for agents (PUT/DELETE …/watch, any project:read), implied watch via depends_on (holder/assignee of a non-done card), watchers:<task id> resolved at write time into a private list stored apart from the event, Readable/Wake-relevant include it, per-reader projection of wakes on such events, task_updated with status and message type 'update' (task_id required, to optional) reach watchers; task_reported does not. CLI: maity watch/unwatch, say --type update --task. Web: watch toggle for everyone, activity list. Tests: two-reader privacy (no watcher ids/counts leak in audience or wakes), write-time vs later watch changes.