fix(cli): share Vault-relative path exclusions

Apply watcher and logical-target exclusions within the selected Vault so
hidden or database-like parent directories do not suppress monitoring.
Protect primary, previous, and view databases, and provide a runtime opt-in
for ordinary database-like directories without changing database ownership.

Cover hidden roots, symlink restarts, exclusion parity, and encrypted
CouchDB create, modify, and delete operations with regression tests.

Refs #1340

test/e2e-cli/ci-tasks.json

@@ -6,6 +6,7 @@
     "test:mirror",
     "test:daemon",
     "test:daemon-startup",
+    "test:daemon-watch-paths",
     "test:push-pull",
     "test:decoupled-vault",
     "test:sync-two-local",