[NopeCharon]

Fixes #179.

Every other observability subcommand (audit, stats, trace, doctor, and the policy, dlp and ratelimit commands) has a usage helper and handles help before doing any work. RunWatch had neither. It never looked at its positionals, so solongate watch help, watch -h and watch --help all started the same blocking live tail as a bare solongate watch, which then had to be interrupted with Ctrl+C. Watch's own flags were documented nowhere in the CLI.

Change

All in packages/cli/observability/watch.go. RunWatch now:

• prints a new watchUsage() for help, -h or --help, and exits 0. The usage lists --filter, --tool, --local-only, --cloud-only and --json, worded like traceUsage.
• refuses any other positional with cliutil.UnknownSub and the usage, as trace and audit do, instead of ignoring it.
• refuses a --filter that is not ALLOW or DENY, using the same wording as audit --filter. DENIED is still accepted, as audit accepts it. Before, --filter blocked was taken and the tail silently matched nothing, forever.
• refuses --local-only together with --cloud-only. Each one turns off the other's source, so the pair polled nothing and printed nothing.

All of these exit before the polling loop starts, since anything that reaches the loop runs until interrupted. Valid invocations behave as before. Nothing on the decision path changes.

Tests

In packages/cli/observability/watch_test.go. The helper runWatchBriefly drives RunWatch under a context deadline, so a case that wrongly falls through to the loop fails with code 130 instead of hanging the suite.

• TestRunWatchHelp: help, -h and --help exit 0, print every flag, and never start the tail. All three fail on main, where they run until the deadline.
• TestRunWatchRejectsBadUsage: an unknown positional, an unknown --filter and the conflicting --local-only --cloud-only pair exit 1 with their message. All three fail on main.
• TestRunWatchAcceptsFilterInAnyCase: deny, Allow and denied still start the tail.

I ran go vet ./... (also with GOOS=windows) and go test -count=1 ./observability/ in packages/cli locally on macOS.