hivectl: add agent <name> watch to follow live events from the CLI

docs/tools/hivectl.md

@@ -266,6 +266,32 @@ lands in a faithful copy of the agent's environment:
   instead of the onboarding/trust dialog the headless harness never
   completes. It's the single place hyperhive touches that file.
 
+## Watch
+
+Follow an agent's live turn/tool-call event stream from the CLI:
+
+```bash
+hivectl agent iris watch    # tail iris's live events; Ctrl-C to stop
+```
+
+Dials the same unix socket the gateway's nginx `proxy_pass`es through
+(`/run/hive-agent/<name>/web.sock` — see [Per-agent unix-socket
+upstream](../gateway.md#per-agent-unix-socket-upstream)) directly and
+speaks a bare HTTP/1.1 request for the agent's existing `/events/stream`
+SSE endpoint over it. No gateway hop, no daemon round-trip for the
+stream itself — the daemon socket is only used for the "does this agent
+exist" pre-flight, same reasoning as `choom` above. Requires the agent
+to be running with its web UI socket bound; a fresh spawn/rebuild that
+hasn't come up yet gets a clear connection-refused hint rather than a
+raw OS error.
+
+Prints one compact line per event — reuses the `_icon`/`_summary` fields
+the harness already stamps onto stream-json events for the web UI
+(`stream_enrich.rs`), so tool calls and turn markers read as short
+glyph-prefixed lines instead of raw JSON. Not an attempt at the web
+UI's full collapsible-details rendering (`docs/terminal-rendering.md`)
+— that's presentation for a browser, this is a `tail -f`.
+
 ## Open
 
 Print (and best-effort open in a browser) one of the hive's web surfaces.