feat: add read-only governance watch plugin

[jadeonstudio]

Summary

Adds governance-watch, a T0 read-only ZeroClaw tool plugin for monitoring finalized SPL Governance ProposalV2 accounts.

• requires a governance public key and applies server-side getProgramAccounts memcmp filters
• parses the on-chain Borsh layout with explicit bounds and response-size limits
• exposes proposal state, voting times, vote weights, options, and transaction progress
• never accepts keys, signs transactions, or submits mutations
• treats proposal text as untrusted on-chain data and withholds prompt-injection-shaped content

Safety boundaries

• read-only Solana JSON-RPC only
• configurable HTTPS RPC endpoint via jailed config_read
• finalized commitment
• maximum 256 RPC accounts, 64 KiB per account, and 5 returned proposals
• rejects mutation-shaped and unknown arguments
• structured logs omit proposal content

Verification

• cargo test --locked: 6 passed
• cargo clippy --locked --all-targets -- -D warnings: passed
• cargo clippy --locked --target wasm32-wasip2 -- -D warnings: passed
• cargo build --locked --target wasm32-wasip2 --release: passed
• repository tools/ci/validate_components.sh governance-watch: passed; 360,250-byte WASM
• live Solana mainnet check: decoded all 66 filtered ProposalV2 accounts returned for governance AZQNzTK3KHW27S3BAyRhx8fSiyH9s5TioaEwHGHa6DPk from a 53,709-byte finalized RPC response

Documentation

The README includes agent usage, configuration, custody tier, threat model, structured logging, and build/test instructions. Licensed MIT.