fix: recover control socket after pathname loss

[teamleaderleo]

Problem

The control socket can become unreachable when its pathname disappears before the directory watcher is armed, or when another inode replaces the bound pathname while the listener is still running. In the first case no filesystem event is delivered to the newly-created watcher. In the second case configuration reconciliation could chmod the replacement path while leaving the original listener unreachable.

What changed

• Queue a generation-validated ownership check immediately after arming the parent-directory watcher, closing the bind-to-watch registration race.
• Refuse live configuration permission updates when the listener no longer owns the bound pathname; the existing stop/start path then performs safe recovery.
• Add behavioral coverage for unlink, inode replacement, repeated recovery, and stale generation callbacks.

Validation

• swift test --package-path Packages/macOS/CmuxControlSocket --filter 'SocketControlServer|SocketTransportPath|SocketListener'
  • 77 tests passed across 13 suites.
• xcodebuild ... -scheme cmux-unit ... build-for-testing
  • TEST BUILD SUCCEEDED.
• git diff --check passed.

The test-only regression commit is intentionally separate from the fix commit so the failure is visible in the PR history.

Related: manaflow-ai#632