Daemon drain (#25): follow-ups after the 2026-10-22 sync #44

Daemon-drain (#25) follow-ups left by the 2026-10-22 sync (#38):

• Long data paths. With a very long data path, upstream moves the daemon socket to /tmp. Preparing the drain then fails and the daemon is safely preserved, as before. Decide whether the drain should support the moved socket.
• Downgrade protection. Upstream's downgrade protection does not see drained daemons running a newer protocol.
• Deferred review findings. The two deferred findings from LOCAL: drain a stale-bundle daemon instead of preserving it (opt-in) #25's review are still open.
• Verify on minidev-alex1. On the first update after sync: upstream ec5eaf96c1 into swaplabs/main #38, check that the host's current daemon, started from the old AppImage mount and now "severed", drains instead of running degraded. sync: upstream ec5eaf96c1 into swaplabs/main #38 made a stale severed daemon drain.