Add a control socket and bundled macterm CLI (read-only verbs)

[thdxg]

First of three PRs for #107 (Macterm CLI) — also groundwork for realistic CI benchmark workloads (#129 follow-up). This slice ships the IPC control plane and the read-only command set; mutations (project create/select, tab new, pane split/run, grid, session kill, layout apply/save) come in PR 2, and the benchmark workload integration in PR 3.

What's here

• Macterm/Control/ControlProtocol.swift — wire types, compiled into both the app and CLI targets so the codec can't drift. One request per connection: newline-terminated JSON both ways, client half-closes after sending. Requests are {v, id, command, args} with noun.verb commands; responses echo id with {ok, data} or a typed error {code, message, action?} where action is a human recovery hint.
• ControlSocketServer — Unix socket at <App Support>/control.sock (per build flavor; follows MACTERM_BENCHMARK_DATA_DIR). Dedicated thread polling a non-blocking listen fd — never a blocking accept() on a queue shared with stop(). Per-connection dispatch hops to @MainActor. Starts at launch; requests before AppState exists get a starting error (so a readiness poll sees a well-formed response). FD_CLOEXEC keeps spawned shells from holding the socket past quit; socket file is 0600 and unlinked on quit.
• ControlHandler — translate-and-delegate only: resolves selectors (name / UUID / 1-based index for projects and tabs; duplicates surface as typed ambiguous errors) and calls the same AppState/ProjectStore/ZmxClient paths the UI uses. Reads zmx via appState.zmx so tests stub one seam.
• CLI/ (MactermCLI tool target → Contents/Resources/bin/macterm) — swift-argument-parser command tree: status, project list, tab list, pane list, session list|info, all with --json. The app prepends the bundled bin dir to PATH and exports MACTERM_SOCKET before any shell spawns, so macterm works inside every pane.

Design notes (from reading cmux, Zentty, Supacode source)

• Socket-ownership check before connect (cmux #389): refuse a socket not owned by the current user.
• Env var is a discovery hint, not a pin (cmux #5146): a stale MACTERM_SOCKET export falls through to the well-known release/debug paths instead of bricking every already-spawned shell after an app restart. Only --socket pins.
• Non-blocking connect + 250ms poll so a dead socket file never hangs the CLI; safe-fail contract (stdout only on success; exit 0/1/2 = ok / app error / unreachable).
• Security posture: same-user only via filesystem permissions — the same boundary zmx itself uses. No token auth by design; the envelope leaves room for an auth field.

Gotcha worth knowing: the CLI target's PRODUCT_NAME is macterm, but PRODUCT_MODULE_NAME must stay MactermCLI — a macterm module collides case-insensitively with the app's Macterm.swiftmodule in the shared products dir and breaks the hosted test target's @testable import.

Testing

• mise run format/lint/test green — new suites: ControlProtocolTests (codec round-trips, forward-compat, hand-built CLI JSON), ControlHandlerTests (queries + selector resolution + zmx stubs against real AppState with tempdir stores), ControlSocketServerTests (real socket round-trips, starting before attach, stale-file replacement, overlong-path refusal, unlink on stop).
• Verified live against the debug app: status, project list, tab list, pane list --json, session list (cross-checked against zmx ls — sessions from another running Macterm instance correctly show as unbound), session info hit/miss, exit-2-with-paths-tried when the app is quit, and socket unlink on quit.

[github-actions]

Window-state benchmark

State	Metric	main@34d98b263	this branch	Δ
focused	CPU %	1.10	0.87	-21%
	Memory (RSS MB)	107.7	107.7	+0%
	CPU ms/s (powermetrics)	10.9	8.7	-20%
	Wakeups/s (powermetrics)	132.1	192.1	+45% 🔺
unfocused	CPU %	1.03	0.80	-23%
	Memory (RSS MB)	112.0	112.0	+0%
	CPU ms/s (powermetrics)	10.2	7.7	-25%
	Wakeups/s (powermetrics)	122.0	178.3	+46% 🔺
minimized	CPU %	0.07	0.13	+99%
	Memory (RSS MB)	112.2	112.2	+0%
	CPU ms/s (powermetrics)	0.8	1.3	+66%
	Wakeups/s (powermetrics)	20.4	79.8	+290% 🔺

⚠️ Labeled benchmark:regression

This PR is labeled benchmark:regression because these metrics regressed by ≥25% vs main@34d98b263 (beyond each metric's absolute noise floor):

• focused — Wakeups/s (powermetrics): 132.1 → 192.1 (+45%)
• unfocused — Wakeups/s (powermetrics): 122.0 → 178.3 (+46%)
• minimized — Wakeups/s (powermetrics): 20.4 → 79.8 (+290%)

30s sampling window per state; CPU % is the process CPU-time delta over the window. Runs land on different shared runners, so treat small deltas as noise — 🔺/🔻 marks changes ≥25% that also clear the metric's absolute noise floor (CPU % ≥0.5, Memory (RSS MB) ≥25, CPU ms/s ≥5, Wakeups/s ≥50), and those add the benchmark:regression / benchmark:improvement label.