Harden daemon control-file permissions

[paulsmith]

Summary

• Harden the daemon control directory, PID file, and Unix socket to owner-only permissions.
• Add regression tests covering daemon dir, PID file, and socket-path permissions.

Why

The local daemon exposes unauthenticated control RPCs, so permissive filesystem modes weakened the boundary around that control surface.

Verification

cd clicker && GOCACHE=/tmp/vibium-gocache go test ./internal/daemon
cd clicker && GOCACHE=/tmp/vibium-gocache go test ./...