fix(server): fix daemon startup race and reduce log bloat

The desktop app could time out connecting to the daemon on first launch
because the PID file advertised a listen address before the HTTP server
was actually listening. The supervisor now writes the PID lock with
listen: null and updates it only after the worker sends a paseo:ready
IPC message confirming the server is listening.

- Rename daemon-runner.ts to supervisor-entrypoint.ts
- PID lock acquired with listen: null, updated via paseo:ready IPC
- Worker sends paseo:ready after httpServer.listen() resolves
- Desktop polls until listen is non-null before returning to the app
- Remove PASEO_PID_LOCK_MODE and external lock mode
- Remove unnecessary env overrides (PASEO_HOME, PASEO_CORS_ORIGINS) from
  desktop daemon spawn
- Reduce trace log bloat: inbound/outbound WebSocket messages now log
  only message type and payload size instead of full payloads
- Supervisor restarts worker on SIGKILL (covers OOM)

packages/cli/src/commands/daemon/local-daemon.ts

@@ -124,11 +124,16 @@ function resolveDaemonRunnerEntry(): string {
       try {
         const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8")) as { name?: string };
         if (packageJson.name === "@getpaseo/server") {
-          const distRunner = path.join(currentDir, "dist", "scripts", "daemon-runner.js");
+          const distRunner = path.join(
+            currentDir,
+            "dist",
+            "scripts",
+            "supervisor-entrypoint.js",
+          );
           if (existsSync(distRunner)) {
             return distRunner;
           }
-          return path.join(currentDir, "scripts", "daemon-runner.ts");
+          return path.join(currentDir, "scripts", "supervisor-entrypoint.ts");
         }
       } catch {
         // Continue searching up if package.json exists but is invalid.