Summary

• Add -w/--watch flag to vigilante logs --access that tails access.jsonl and renders new entries as they arrive
• Decode each JSON line into a human-readable structured format: timestamp, ✓/✗ status, execution context, command + args, duration, and optional repo/issue/exit details
• Malformed lines are surfaced with a [malformed] prefix instead of crashing the viewer
• The -w flag is scoped to --access only — using it without --access produces a clear validation error
• The persisted access.jsonl format remains unchanged

Changed files

• internal/app/logs.go — new file with access log renderer, watch mode, and duration formatting
• internal/app/app.go — wire -w/--watch flag, use pretty rendering for --access, pass context to logs command
• internal/app/logs_test.go — new tests for renderer, watch/follow, malformed lines, flag validation
• internal/app/app_test.go — update existing access log test for pretty output format

Test plan

• TestFormatAccessLogEntry — verifies structured rendering of a successful entry with repo/issue details
• TestFormatAccessLogEntryFailure — verifies failure indicator and exit code display
• TestFormatDuration — verifies ms/s/m formatting thresholds
• TestRenderAccessLogLines — verifies multi-entry JSONL rendering
• TestRenderAccessLogLinesMalformed — verifies graceful handling of bad JSON lines
• TestRenderAccessLogLinesEmpty — verifies empty input produces no output
• TestWatchAccessLogStopsOnContextCancellation — verifies clean shutdown
• TestWatchAccessLogMissingFile — verifies error for nonexistent log
• TestLogsWatchFlagRequiresAccess — verifies -w without --access is rejected
• TestLogsAccessWatchFlag — verifies end-to-end via app.Run
• TestWatchAccessLogPicksUpNewEntries — verifies tail behavior picks up appended entries
• Full test suite passes with no regressions

Closes #320