resume_replies gains an arm_in_flight refusal and a watch-stop explanation

The artifact auto-reply resume path adds a new refusal case: if a live-watch connection started before the watch was stopped and is still winding down, a resume cannot attach to it (arm_in_flight). Separately, when it's the artifact's own watch stop, rather than a separate auto-reply stop, that's holding replies back, resume now denies with a decision reason stating that only an approved re-watch can clear it, and the permission description tells the user that resuming will also re-watch.