fix(server): fix daemon startup race and reduce log bloat

The desktop app could time out connecting to the daemon on first launch
because the PID file advertised a listen address before the HTTP server
was actually listening. The supervisor now writes the PID lock with
listen: null and updates it only after the worker sends a paseo:ready
IPC message confirming the server is listening.

- Rename daemon-runner.ts to supervisor-entrypoint.ts
- PID lock acquired with listen: null, updated via paseo:ready IPC
- Worker sends paseo:ready after httpServer.listen() resolves
- Desktop polls until listen is non-null before returning to the app
- Remove PASEO_PID_LOCK_MODE and external lock mode
- Remove unnecessary env overrides (PASEO_HOME, PASEO_CORS_ORIGINS) from
  desktop daemon spawn
- Reduce trace log bloat: inbound/outbound WebSocket messages now log
  only message type and payload size instead of full payloads
- Supervisor restarts worker on SIGKILL (covers OOM)

packages/server/scripts/supervision-parity.test.ts

@@ -3,7 +3,10 @@ import { describe, expect, test } from "vitest";
 
 describe("supervision parity", () => {
   test("has exactly one runtime callsite for runSupervisor", () => {
-    const daemonRunner = readFileSync(new URL("./daemon-runner.ts", import.meta.url), "utf8");
+    const daemonRunner = readFileSync(
+      new URL("./supervisor-entrypoint.ts", import.meta.url),
+      "utf8",
+    );
     const devRunner = readFileSync(new URL("./dev-runner.ts", import.meta.url), "utf8");
 
     const daemonRunnerCalls = (daemonRunner.match(/\brunSupervisor\s*\(/g) ?? []).length;