Harden daemon: enforce the API socket resolves inside COVEN_HOME (AUTH.md L134)

[maplesyzzurp]

Closes the socket-path-containment item from docs/AUTH.md's "Current hardening gap" (L134/L136): the daemon should fail closed when the socket path resolves outside COVEN_HOME, or when socket creation/cleanup would cross the trusted state-directory boundary.

What

bind_api_socket now verifies the socket path is a direct child of COVEN_HOME before touching it:

if socket_path.parent() != Some(coven_home) {
    anyhow::bail!("refusing to bind Coven API socket {}: resolves outside Coven home {}", ...);
}

daemon_socket_path() builds <coven_home>/coven.sock, so this held only by construction. The guard makes the invariant explicit, so a future refactor (e.g. a configurable socket path) can't silently let socket creation or cleanup escape the trusted directory.

Together with #144 (symlink/non-socket) and #148 (ownership), this completes the AUTH.md daemon-hardening list.

Tests

• New daemon_socket_path_stays_inside_coven_home invariant test.
• Existing socket/permission tests unchanged and green.
• cargo test --workspace green, clippy -D warnings clean, fmt clean.

Focused hardening change, in the same vein as #144 / #145 / #148.