Declare the daemon entry surface and stop daemon-client importing daemon internals

[thymikee]

Parent: #2542. The classifier half landed in #2557; this is the entry half.

Problem

src/daemon-client/** reaches into daemon internals on the value side, and nothing declares which
root module is allowed to import the daemon zone in the first place. Measured at the #2557 tip: 13
daemon-client -> src/daemon/** pairs, of which 8 are value edges.

target	LOC	inbound files	what the client needs
src/daemon/config.ts	113	42	state dir / port / token resolution
src/daemon/daemon-process.ts	122	4	pidfile + liveness discovery
src/daemon/session-repair-tombstone.ts	91	2	tombstone path + read
src/daemon/request-progress-protocol.ts	48	3	progress event framing
src/daemon/daemon-request.ts	—	—	4 type-only request/response shapes

Three of the four value targets have tiny inbound sets and no daemon-only dependencies, so they are
shared on-disk/protocol contract rather than daemon internals. config.ts is the odd one: 42 inbound
files, so the client's need has to be cut down to the subset it actually reads instead of moving the
whole module. The daemon-request.ts type edges belong to the wire half that #2318/#2322 already split
into daemon-request-wire.ts.

Desired behaviour

• One declared entry surface names which modules may import the daemon zone, and it is the process
  root composition — not daemon-client.
• The four value targets above are reached through a location that is not daemon internals: relocated
  where the inbound set is small, or narrowed to the subset the client reads for config.ts.
• The residue is ratchet-declared shrink-only, and every entry in it names a measured edge, not a
  directory.

Acceptance

• daemon-client -> src/daemon/** value edges: 0.
• Type-only daemon-request.ts edges resolved against daemon-request-wire.ts or recorded with a
  rationale for keeping them.
• A planted daemon-client import of a daemon-internal module is red, and a stale declaration entry is
  red.