fix(monitor): add status enum docs + subscribe security warning (FW-09, FW-15)

FW-09: SKILL.md defines valid last_visible_status values (running/stopped/
  terminated/archived). reconcile.sh now sets last_visible_status to
  'running' and uses last_visible_note for free-form comments.

FW-15: SKILL.md adds Security section for --subscribe on public brokers.
  Documents wildcard subscription risks, auto-kill spoofing, HMAC
  verification mitigation, and recommends --once/polling for PoC.

skills/tmux-agent-orchestrate-monitor/scripts/reconcile.sh

@@ -343,7 +343,8 @@ if tmux_confirmed:
             'start_command': f'tmux {server_opt}new-session -d -s "{name}" -x 140 -y 40 -c "{pm["cwd"]}" "{cmd_full}"',
             'attach_command': f'tmux {server_opt}attach -t {name}',
             'kill_command': f'tmux {server_opt}kill-session -t {name}',
-            'last_visible_status': 'auto-registered by monitor',
+            'last_visible_status': 'running',
+            'last_visible_note': 'auto-registered by monitor',
         }
         if agent == 'claude':
             entry['tui'] = {'model': '(unknown — capture after first message)', 'provider': 'anthropic',