Declare the daemon entry surface and stop daemon-client importing daemon internals #2559

Parent: #2542. The classifier half landed in #2557; this is the entry half.

Problem

src/daemon-client/** reaches into daemon internals on the value side, and nothing declares which
root module is allowed to import the daemon zone in the first place. Measured at the #2557 tip: 13
daemon-client -> src/daemon/** pairs, of which 8 are value edges.

Three of the four value targets have tiny inbound sets and no daemon-only dependencies, so they are
shared on-disk/protocol contract rather than daemon internals. config.ts is the odd one: 42 inbound
files, so the client's need has to be cut down to the subset it actually reads instead of moving the
whole module. The daemon-request.ts type edges belong to the wire half that #2318/#2322 already split
into daemon-request-wire.ts.

Desired behaviour

• One declared entry surface names which modules may import the daemon zone, and it is the process
  root composition — not daemon-client.
• The four value targets above are reached through a location that is not daemon internals: relocated
  where the inbound set is small, or narrowed to the subset the client reads for config.ts.
• The residue is ratchet-declared shrink-only, and every entry in it names a measured edge, not a
  directory.

Acceptance

• daemon-client -> src/daemon/** value edges: 0.
• Type-only daemon-request.ts edges resolved against daemon-request-wire.ts or recorded with a
  rationale for keeping them.
• A planted daemon-client import of a daemon-internal module is red, and a stale declaration entry is
  red.