Harden daemon trust boundaries

[c1-squire-dev]

Summary

• propagate --allowed-binaries into lazily spawned daemons from CLI and MCP entry points
• tighten executable allowlist semantics so bare names only match bare argv[0], while path-style invocations require exact canonical path entries
• gate daemon upgrade through the same executable governance path as spawn
• enforce user-owned 0700 daemon socket roots on Unix
• bound daemon and MCP JSON-RPC line frames to 1 MiB
• restrict PNG snapshot writes to new relative files under the daemon cwd, rejecting absolute/traversal paths and overwrites
• add focused regressions for lazy-spawn governance, allowlist bypasses, socket permissions, bounded frames, and PNG path policy

Testing

• cargo fmt --all -- --check
• RUSTFLAGS='-D warnings' cargo test --workspace
• RUSTFLAGS='-D warnings' cargo clippy --workspace --all-targets -- -D warnings
• focused rerun: RUSTFLAGS='-D warnings' cargo test -p agent-tui-daemon --test round_trip snapshot_png -- --nocapture