Watchers: double opt-in

redoal_watchers starts pending; /watching (the confirmation mail's
landing page) confirms to open or drops. Only open watchers are told.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

aggregates.yaml

@@ -14,10 +14,15 @@ aggregates:
       unsubscribed: { event: unsubscribed }
     transitions:
       open: [unsubscribed]
+  # Double opt-in: a watcher is pending until the address confirms from
+  # the mail n8n sends (redoal: confirm watching); only open watchers
+  # are told when something lands at their shape.
   - bucket: redoal_watchers
-    initial: open
+    initial: pending
     states:
-      open: { event: subscribed }
+      pending: { event: requested }
+      open: { event: confirmed }
       unsubscribed: { event: unsubscribed }
     transitions:
+      pending: [open, unsubscribed]
       open: [unsubscribed]