feat(FM.2): warm observe-only ambient monitor daemon

[Maqbool61]

Closes #237.

doberman monitor run/doberman monitor status — the warm, observe-only
daemon on top of the FM.1 activity bus. Each tick: polls every
doberman.collectors entry point, emits onto the bus, drains from the
daemon's own saved cursor (crash-resumable, no replay/loss), and scores each
event through the same decide() the live gate uses — recording an alert row
via record_decision(..., source_context_override="ambient:<collector_id>").

Hard rules, each with its own test:

• Observe-only, structurally — an AST-based test asserts
  monitor/daemon.py never statically imports doberman.auth or
  doberman.proxy.
• No output may read as "blocked" — doberman.explain, doberman.render
  (used by doberman log/status), and doberman tui all detect the
  "ambient:" source-context shape and prefix explanations with
  "observed (not enforced): ", replacing "blocked"/"pending auth" language
  with a neutral alert word. Structured output (--jsonl) keeps the true
  verdict for scripts/SIEMs — only human-facing text is softened.
• No learning from ambient input — a test snapshots every baseline/
  revealed-preference table before and after a real multi-tick daemon run
  and asserts byte-for-byte equality, plus an import-boundary test that the
  daemon never reaches doberman.subjective.baseline/drift/martingale/
  revealed.
• A dead daemon changes nothing about inline protection — a dedicated
  test (mirroring test_import_boundaries.py's existing pattern) exercises
  the "Policy core must not depend on the ambient monitor" import-linter
  contract programmatically, not just via CI's lint-imports step.
• Per-event isolation and the conservative-alert-on-scoring-failure fallback
  (ReasonCode.ambient_scoring_error) are both covered directly.

Also: a heartbeat + single-instance guard (refuses a second monitor run for
the same repo), doberman monitor status for liveness/cursor/backlog, and
docs/changelog updates.

CI: all 12 required checks pass (lint/boundaries/docs parity, package
smoke tests on ubuntu/windows, secret-scan, and the full test matrix across
3.11/3.12/3.13). Locally I saw two failures unrelated to this change — a
GUI-geometry test sensitive to local font metrics, and an integration test
whose system_site_packages venv fixture can't see a project-venv install —
neither reproduces here in CI, confirming they're local-environment-only.