Introduce transfer executor boundary

[talbotai]

Summary

• introduce an in-process transfer executor boundary around command execution
• route command path preparation, rsync start/wait/kill, and guarded source cleanup through the executor
• keep current single-process behavior and rsync cwd/relative-path semantics unchanged

This is the first foundation step toward the later lean core + restricted worker split. It intentionally does not introduce a socket, worker process, startup script changes, or privilege changes.

Validation

• go test ./daemon/lib
• GOOS=linux GOARCH=amd64 go test -c ./daemon/services/core -o /tmp/unbalance-core-executor.test
• GOOS=linux GOARCH=amd64 go test -c ./daemon/services/server -o /tmp/unbalance-server-executor.test
• make release

Manual hal validation

Test binary deployed to /usr/local/emhttp/plugins/unbalanced/unbalanced on hal with backup:

• backup: /usr/local/emhttp/plugins/unbalanced/unbalanced.bak.20260503-095840
• sha256: 7f8b826e6b750c63079beb0d1536dd829711d787bc6472f4b63da8337450f4b5

Manual fixture validation passed:

• Scatter copy with two 1 GiB payload files: completed with retcode(0):exitcode(0) and expected destination files/checksums.
• Scatter move with the same fixture: completed with retcode(0):exitcode(0), removed source folders, preserved destination payload.
• Gather move disk2 → disk1 with 512 MiB + 256 MiB payloads: completed with retcode(0):exitcode(0), removed source folders, pruned the source fixture root, and verified final disk1 filesystem state.

No unsafe-path, blocked, interrupted, or operation error lines were observed for the executor-interface fixtures.

Notes

Native macOS core tests are still blocked by the existing Darwin compile mismatch in daemon/services/core/array.go; Linux-targeted core/server compilation was used as the validation gate for those packages.