fix(rust): fail-closed token auth on both shadow daemons (delegation seam P1)

[webdevtodayjason]

What

Implements P1 from the delegation seam design (PR #469, §4) — the security prerequisite that gates all read-only adoption work. Closes the auth gaps the seam review surfaced (doc ground truth #7):

• argent-execd had zero auth on any route — including POST /v1/executive/shutdown. Now every route requires a bearer token (constant-time compare), and the daemon refuses to start without a token unless ARGENT_EXECD_ALLOW_NO_AUTH=1.
• argentd was fail-open when ARGENTD_AUTH_TOKEN was empty (the ws connect gate only rejects on mismatch when the expected token is non-empty). Adds a matching fail-closed startup guard with the same opt-out flag.
• TS ExecutiveShadowClient learns a bearer token; getExecutiveShadowSummary resolves it from ARGENT_EXECD_AUTH_TOKEN or ~/.argentos/rust-execd/auth-token, so argent status keeps reaching a token-enforcing installed daemon.

Verification

• New execd auth test: 401 on missing/wrong token (incl. an unauthenticated shutdown attempt that must be denied), 200 on correct token.
• argentd startup guard verified: refuses tokenless start, starts under the opt-out.
• All Rust tests green (argentd 37 ws + 14 http + units; execd http_control incl. new auth test).
• 26 TS execd/status tests green; no net-new TS errors (189 baseline).
• Live daemon confirmed: curl → 401 without token, 200 with; status-path via the token file → kernel: fail-closed.

Rollout note (operator step)

Arming the installed execd token is a coordinated deploy step: this PR's daemon binary + CLI token-reader must land together. The live plist is currently staged with ARGENT_EXECD_ALLOW_NO_AUTH=1 (its prior unauthenticated behavior — no regression, argent status green). On deploy: drop the opt-out, set ARGENT_EXECD_AUTH_TOKEN in the plist (token staged at ~/.argentos/rust-execd/auth-token), bounce the LaunchAgent.

Follows the seam doc's I6 (no unauthenticated/fail-open daemon surface). Closet 🔴 item resolved by this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T3dkQzz2mSrSNtGBE9cmXr

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 8fb062ef-e869-4889-82f6-c6f47137d9dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/daemon-auth-p1

---

_{Comment @coderabbitai help to get the list of available commands.}