Watch the world folder: auto spawn/upgrade, broker watch/unwatch, retire scan

The host watches the whole world folder recursively with the notify crate
(any writer counts, .sausage-tmp-* skipped, ~100 ms coalescing per path).
A new or changed actor/<id>/actor.wasm (or new folder actor/<id>) is
booted as at start once quiet: new = spawn (tested first), changed =
upgrade. The broker `scan` request is gone; the boot pass stays, plus a
full pass when the OS watcher overflows.

New broker requests watch/unwatch {path} (saved in actor.json `watches`)
deliver fs_changed {path, op: write|create|remove|rename, to?} from `fs`,
not routed, dropped when the mailbox is full; overflow sends every watcher
one fs_changed {path:"/actor", op:"rescan"}.

Card #91 (multi-host step 1).

cli/src/world.rs

@@ -1,11 +1,12 @@
 //! On-disk layout of a Sausage world. The folder is the source of truth:
-//! `sausage run` boots every actor that it finds in `actor/`.
+//! `sausage run` boots every actor that it finds in `actor/`, and then
+//! watches the folder (`watch.rs`).
 //!
 //! ```text
 //! <world>/
 //!   actor/<id>/
 //!     actor.wasm        the current version
-//!     actor.json        version, running, subscriptions, tapped (broker)
+//!     actor.json        version, running, subscriptions, tapped, watches (broker)
 //!     source/           source of the current version
 //!     public/           written by the actor, read-only for others
 //!     data/             state, writable only by the actor
@@ -46,6 +47,9 @@ pub struct ActorMeta {
     /// Whether this actor gets a copy of every routed message (`tap`).
     #[serde(default)]
     pub tapped: bool,
+    /// Namespace paths whose changes this actor gets as `fs_changed` (`watch`).
+    #[serde(default)]
+    pub watches: BTreeSet<String>,
 }
 
 fn yes() -> bool {