`dotagent pause` / `dotagent resume` — suspend without editing manifest

When an agent is misbehaving — flapping, leaking memory, hitting a rate limit — the operator's only tool today is to comment out the schedule in the manifest, push, reload. That is high-friction and ugly to revert.

There should be a one-liner to suspend an agent until the operator says otherwise.

## Proposal

Two new subcommands:

```
dotagent pause # all schedules
dotagent pause / # just one schedule
dotagent pause --reason "rate limit at upstream"
dotagent pause --until 2026-06-01T10:00:00

dotagent resume
dotagent resume /
```

Pause writes a marker file under `~/.config/dotagent/state/paused/[__].json` with `paused_at`, `reason`, optional `until`. The scheduler checks this file before firing.

If `until` is set, the daemon resumes automatically when the time arrives.

## Acceptance criteria

- [ ] `dotagent pause hello-fish` suspends all schedules; `dotagent status` shows `paused`.
- [ ] `dotagent pause hello-fish/morning` suspends just one schedule.
- [ ] `--reason` is stored and shown in `status` and `why`.
- [ ] `--until` auto-resumes at the given time.
- [ ] `dotagent resume` clears the marker.
- [ ] Audit log records `agent_paused` and `agent_resumed` events.
- [ ] [`agent-spec.md`](docs/reference/agent-spec.md) gains a "Pause/resume" section.

## Where to start

- `crates/dotagent-state/src/lib.rs` — new marker file shape.
- `crates/dotagent/src/commands/daemon.rs` — tick loop check.
- `crates/dotagent/src/commands/output.rs` — render the new state.

## Non-goals

- Pausing the whole daemon. That is `launchctl unload` / `systemctl stop` territory.
- Per-window pause. Per-schedule is enough granularity for v1.

Start with crates/dotagent-state/src/lib.rs for the marker shape, then trace the tick loop in crates/dotagent/src/commands/daemon.rs and rendering in crates/dotagent/src/commands/output.rs. Verify the pause, resume, reason, until, status, why, scheduling, and audit-log acceptance criteria, and add the requested Pause/resume section to docs/reference/agent-spec.md.

Written by the indexing model from the issue text.