Feat/watchdog (#64)

* feat: add Watchdog LLM-as-judge feature

Adds Watchdog, an LLM-based evaluation layer for AI agent tool calls.
Watchdog provides semantic security analysis that complements Rego policies.

Key features:
- Backend abstraction trait for swappable LLM providers
- OpenRouter backend implementation (HTTP API)
- Directory-based configuration (.cupcake/watchdog/)
- Custom prompts via system.txt and user.txt files
- Dry-run mode for testing without API calls
- Fail-open/fail-closed error handling

Configuration:
- Enable in rulebook.yml: `watchdog: true`
- Settings in .cupcake/watchdog/config.json
- Precedence: project -> global -> defaults

Policy integration:
- Results available at input.signals.watchdog
- Fields: allow, confidence, reasoning, concerns, suggestions

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* watchdog context, image in docs

* add cucpake flow diagram, better language

* refine readme

* refine readme

* refine readme

* refine readme

* refine readme

* refine readme

* chore: ci fixes

* code and design quality fixes

* png to avif

* sad revert to png

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: backnotprop

.gitignore

@@ -102,3 +102,4 @@ notes.note
 
 # todo: considering enabling again later
 .claude/commands
+temp-reference/