Add ATVM watcher service and explicit watcher approval flow

- add the per-run ATVM watcher service package under atvm/watcher-service, including the Python watcher, systemd template unit, helper scripts, and deployment docs
- document the watcher-service install and operating model, including one-run-per-instance behavior, Mattermost posting rules, and the best-practice /opt/atvm-watcher-service install path
- clarify ATVM run approval semantics so `approve` means run without watcher and `approve with watcher` means run and start the watcher
- update the ATVM automation guide and AGENTS rules so watcher usage and approval behavior are explicit and consistent

atvm/watcher-service/start-atvm-run-watcher.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  start-atvm-run-watcher.sh --build-name <name> [options]
+
+Options:
+  --build-name <name>
+  --template <name>
+  --config-family <name>
+  --migration-style <text>
+  --integration-plugin <text>
+  --scope-description <text>
+  --state-root <path>   Default: /var/lib/atvm-run-watcher
+EOF
+}
+
+BUILD_NAME=""
+TEMPLATE=""
+CONFIG_FAMILY=""
+MIGRATION_STYLE=""
+INTEGRATION_PLUGIN=""
+SCOPE_DESCRIPTION=""
+STATE_ROOT="/var/lib/atvm-run-watcher"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --build-name) BUILD_NAME="${2:-}"; shift 2 ;;
+    --template) TEMPLATE="${2:-}"; shift 2 ;;
+    --config-family) CONFIG_FAMILY="${2:-}"; shift 2 ;;
+    --migration-style) MIGRATION_STYLE="${2:-}"; shift 2 ;;
+    --integration-plugin) INTEGRATION_PLUGIN="${2:-}"; shift 2 ;;
+    --scope-description) SCOPE_DESCRIPTION="${2:-}"; shift 2 ;;
+    --state-root) STATE_ROOT="${2:-}"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Unknown argument: $1" >&2; usage >&2; exit 1 ;;
+  esac
+done
+
+if [[ -z "$BUILD_NAME" ]]; then
+  echo "--build-name is required" >&2
+  usage >&2
+  exit 1
+fi
+
+RUN_DIR="${STATE_ROOT}/${BUILD_NAME}"
+mkdir -p "$RUN_DIR"
+
+cat >"${RUN_DIR}/watch.env" <<EOF
+ATVM_WATCHER_TEMPLATE=${TEMPLATE@Q}
+ATVM_WATCHER_CONFIG_FAMILY=${CONFIG_FAMILY@Q}
+ATVM_WATCHER_MIGRATION_STYLE=${MIGRATION_STYLE@Q}
+ATVM_WATCHER_INTEGRATION_PLUGIN=${INTEGRATION_PLUGIN@Q}
+ATVM_WATCHER_SCOPE_DESCRIPTION=${SCOPE_DESCRIPTION@Q}
+EOF
+
+systemctl start "atvm-run-watcher@${BUILD_NAME}.service"
+systemctl status --no-pager "atvm-run-watcher@${BUILD_NAME}.service" || true