fix(server): fix daemon startup race and reduce log bloat

The desktop app could time out connecting to the daemon on first launch
because the PID file advertised a listen address before the HTTP server
was actually listening. The supervisor now writes the PID lock with
listen: null and updates it only after the worker sends a paseo:ready
IPC message confirming the server is listening.

- Rename daemon-runner.ts to supervisor-entrypoint.ts
- PID lock acquired with listen: null, updated via paseo:ready IPC
- Worker sends paseo:ready after httpServer.listen() resolves
- Desktop polls until listen is non-null before returning to the app
- Remove PASEO_PID_LOCK_MODE and external lock mode
- Remove unnecessary env overrides (PASEO_HOME, PASEO_CORS_ORIGINS) from
  desktop daemon spawn
- Reduce trace log bloat: inbound/outbound WebSocket messages now log
  only message type and payload size instead of full payloads
- Supervisor restarts worker on SIGKILL (covers OOM)

packages/app/src/desktop/daemon/desktop-daemon.ts

@@ -6,7 +6,7 @@ export type DesktopDaemonState = "starting" | "running" | "stopped" | "errored";
 export type DesktopDaemonStatus = {
   serverId: string;
   status: DesktopDaemonState;
-  listen: string;
+  listen: string | null;
   hostname: string | null;
   pid: number | null;
   home: string;
@@ -82,7 +82,7 @@ function parseDesktopDaemonStatus(raw: unknown): DesktopDaemonStatus {
   return {
     serverId: toStringOrNull(raw.serverId) ?? "",
     status: parseDesktopDaemonState(raw.status),
-    listen: toStringOrNull(raw.listen) ?? "",
+    listen: toStringOrNull(raw.listen),
     hostname: toStringOrNull(raw.hostname),
     pid: toNumberOrNull(raw.pid),
     home: toStringOrNull(raw.home) ?? "",

packages/app/src/runtime/host-runtime.ts

@@ -1172,7 +1172,7 @@ export class HostRuntimeStore {
   async bootstrapDesktop(): Promise<HostRuntimeBootstrapResult> {
     try {
       const daemon = await startDesktopDaemon();
-      const listenAddress = daemon.listen.trim();
+      const listenAddress = daemon.listen?.trim() ?? "";
       const serverId = daemon.serverId.trim();
       if (!listenAddress) {
         return {