Protected paths unwatched

Protected filesystem paths must never be watched. Watching them looks read-only, but creates persistent observation of security-sensitive locations and bypasses the protected-path boundary; reject watch registration before creating any filesystem handle.