T-124: unix-domain IPC server, wired into Flutter app boot

First slice of T-99 (the D-56-path-a IPC server). What this lands:

* lib/src/ipc/paths.dart rewritten — `workspaceSocketPath(root)`
  returns the per-workspace path per D-70 (FNV-1a 64-bit hash, hex,
  no crypto dep — D-70 amended in this commit to record the hash
  choice). Old `defaultSocketPath()` removed; the lone fallback in
  facade.dart kept with a clear placeholder pending T-127.
* lib/src/ipc/server.dart — IpcServer class. ServerSocket.listen
  accept loop (D-72), 0600 socket + 0700 parent (D-71), stale-node
  probe + unlink on start, refuses to clobber a live listener.
* lib/main.dart — IpcServer started after the first dispatcher is
  built and swapped on project open (workspace path changes).
  Failure logged but non-fatal so the UI still works without IPC.
* 11 server tests + 5 path tests cover socket modes, multi-conn,
  stale unlink, live-conflict, idempotent start/stop.

T-99 children downstream of T-124 (T-125 / T-126 / T-127 / T-130)
are now unblocked.

Co-Authored-By: Claude <noreply@anthropic.com>

lib/kernel/src/facade.dart

@@ -1,7 +1,6 @@
 import 'dart:async';
 import 'dart:io';
 
-import 'package:clide/clide.dart';
 import 'package:clide/kernel/src/clipboard.dart';
 import 'package:clide/kernel/src/commands/keybindings.dart';
 import 'package:clide/kernel/src/keymap/keymap_service.dart';
@@ -167,7 +166,14 @@ class KernelServices {
         (daemonClientFactory != null
             ? daemonClientFactory(log, events)
             : DaemonClient(
-                socketPath: socketPath ?? defaultSocketPath(),
+                // Legacy socket-client fallback — kept until T-127
+                // replaces it with the in-process socket loopback.
+                // Today nothing in production hits this branch
+                // (main.dart and the test harness pass an explicit
+                // daemonClientFactory). If a caller does land here
+                // without `autoStartDaemonClient: false`, the
+                // placeholder path makes the failure mode obvious.
+                socketPath: socketPath ?? '/dev/null/clide-legacy.sock',
                 log: log,
                 events: events,
               ));