fix(daemon): preserve live legacy locks

[cbeaulieu-gt]

Summary

• decode legacy plain-decimal PID records instead of treating them as corrupt
• preserve a live legacy holder when socket identity cannot be proved or disproved
• serialize stale-artifact cleanup with the project writer lock and revalidate the exact lock snapshot before deletion
• prevent daemon startup or in-process fallback from creating a second writer during takeover races
• add regression coverage across decoding, startup, fallback, cleanup, stop, registry, and CLI behavior
• document the fix in the unreleased changelog

Why the scope is broader than the parser fix

Recognizing the legacy PID makes its live state visible, but the takeover and fallback paths must also treat missing identity metadata as inconclusive. The cleanup fencing and snapshot checks preserve the existing PID-reuse protection while preventing a delayed or legacy daemon from overlapping another writer.

Verification

• npm run build — passed
• six focused daemon/lock suites — 56 passed, 2 failed, 6 skipped on Windows
• the two failures are environment-specific: an unchanged test assumes PID 1 is alive, and one daemon test passes its assertions but receives EPERM while removing its temporary directory
• isolated new writer-lock regression cases — 2 passed
• isolated new daemon identity/fallback regression cases — 3 passed
• hosted CI remains the clean-platform check

Fixes #1834

🤖 Generated by Codex on behalf of @cbeaulieu-gt