Watchers: double opt-in

redoal_watchers starts pending; /watching (the confirmation mail's
landing page) confirms to open or drops. Only open watchers are told.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

questions/watching.yaml

@@ -0,0 +1,27 @@
+# Landing page of the confirmation mail: /watching?chain=<record>&email=<address>.
+# A followup - never in the nav; the record id in the link is the only
+# way here, and it plus the matching email is what authorizes the
+# transition (portal's self_transition).
+followup: true
+name: Are you watching this address?
+description: >
+  Someone asked to hear from a shape on redoal with your address. Say
+  yes and you get one note when something is left there — nothing
+  else, ever. Say it wasn't you and the request is dropped.
+alternatives:
+  - name: Yes, watch it
+    description: >
+      One note per day at most, only when a recording or a program
+      lands at exactly this shape.
+    self_transition:
+      bucket: redoal_watchers
+      to: open
+      label: Yes, watch it
+
+  - name: That wasn't me
+    description: >
+      The request is dropped and the address stays unused.
+    self_transition:
+      bucket: redoal_watchers
+      to: unsubscribed
+      label: Drop it