Add ATVM watcher service and explicit watcher approval flow

- add the per-run ATVM watcher service package under atvm/watcher-service, including the Python watcher, systemd template unit, helper scripts, and deployment docs
- document the watcher-service install and operating model, including one-run-per-instance behavior, Mattermost posting rules, and the best-practice /opt/atvm-watcher-service install path
- clarify ATVM run approval semantics so `approve` means run without watcher and `approve with watcher` means run and start the watcher
- update the ATVM automation guide and AGENTS rules so watcher usage and approval behavior are explicit and consistent

atvm/watcher-service/atvm-run-watcher@.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=ATVM run watcher for %i
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/atvm-watcher-service
+EnvironmentFile=-/etc/atvm-run-watcher.env
+EnvironmentFile=-/var/lib/atvm-run-watcher/%i/watch.env
+ExecStart=/usr/bin/env python3 /opt/atvm-watcher-service/atvm_run_watcher.py --build-name %i --run-log /tmp/%i.log --reporter-root /root/cdc-e2e-cyp-12.17.4/cypress/cmcReporter --inventory-file /opt/atvm-watcher-service/vm-inventory.md --state-dir /var/lib/atvm-run-watcher
+Restart=no
+
+[Install]
+WantedBy=multi-user.target