“Watermarking changes refusal behavior on bare harmful requests, but the effect is more pronounced when the same requests are ...