refactor: constrain complexity of run_watch_file

[dean0x]

Location: crates/mds-cli/src/watch.rs:886

What: run_watch_file is ~311 lines, fully pre-existing. No changes by PR #253, but sits at a complexity boundary worth documenting.

Why deferred: Fully pre-existing behavior. Refactoring cost exceeds benefit when scoped as part of a security hardening PR.

Source review: .devflow/docs/reviews/fix-esc-injection-176/2026-07-25_1625 (complexity-6)

Acceptance Criteria:

• Consider splitting run_watch_file into smaller, single-responsibility functions
• Document the current call graph and state machine
• Verify no regression in watch behavior

Note: This is a low-priority refactor; the function works correctly as-is.