clawd daemon + local socket API

[kortiene]

Context

Today every claw CLI invocation re-opens the SQLite store, re-reads the manifests, and re-instantiates PodmanClient. This is fine for a single-operator workflow but blocks: long-lived watchers, the Telegram bot needing to query agent state without bootstrapping the full CLI, and any future TUI/dashboard.

clawd should expose a local Unix-socket JSON API at ~/.claw/run/clawd.sock that the CLI, the bot, and any future client speak to.

Source: docs/SPRINT_PLAN.md §8.

Acceptance criteria

• clawd start daemonizes (or runs in foreground with --foreground); writes PID to ~/.claw/run/clawd.pid.
• Socket at ~/.claw/run/clawd.sock, perms 0o600, JSON line protocol.
• Verbs: agent.list, agent.get, agent.create, agent.start, agent.stop, agent.delete, policy.explain, policy.mutate, audit.tail.
• CLI gains --via-daemon flag (and a setting in ~/.claw/config.yaml) that routes commands through the socket instead of re-bootstrapping.
• claw doctor reports daemon status (running / not running / socket unreachable).
• Telegram bot uses the daemon socket for /status instead of opening the SQLite store directly.

Out of scope

• Network-exposed API (TCP/HTTP) — defer to v0.4.
• Multi-tenant clawd — single-user assumption stays.

References

• docs/SPRINT_PLAN.md §8
• Related: Runtime policy mutation: claw tools/skills allow|deny #1 (runtime policy mutation needs this for the bot path)