fix(cua-driver): keep macOS daemon stable during permission setup

[injaneity]

summary

• move macOS TCC status and prompt operations into short-lived copies of the signed app executable
• keep the long-lived daemon free of cached negative TCC preflights, eliminating its execvp restart loop
• keep the public socket and PID stable throughout first-launch permission setup
• reject calls before execution with the existing daemon error shape and exit code 75 until a fresh probe confirms grants

Closes #3300

root cause

AXIsProcessTrusted and CGPreflightScreenCaptureAccess cache negative results per process. The permission gate previously cleared those caches by replacing the whole daemon process. Since #1773, that process already owned the public socket, so each planned refresh destroyed accepted connections and produced an EOF.

architecture

The daemon is the stable control plane. It binds once and never performs a negative TCC preflight while gated. A hidden finite entry point runs before normal CLI initialization; the gate starts a fresh signed child for each status poll and for the one prompt request. Those children can observe current TCC state without poisoning the process that later runs desktop tools.

While probes are pending, the daemon remains discoverable but no tool action starts. Calls receive permissions_pending with exit code 75 through the existing response protocol. Once a fresh child confirms both grants, the same daemon generation enables dispatch. If a helper cannot start or return valid status, the daemon fails closed and remains gated.

This removes the gate re-exec loop rather than masking its transport failure. The probe implementation remains macOS-specific; it does not add a speculative cross-platform lifecycle framework.

validation

• cargo fmt --all -- --check
• cargo check -p platform-macos -p cua-driver --tests
• cargo test -p platform-macos permissions::gate::tests --lib — 13 passed
• cargo test -p cua-driver permission_gate_routing_tests --bin cua-driver — 2 passed
• debug binary probe smoke returned valid permission JSON
• logged-in, app-attributed TCC-reset reproduction proving one stable PID/socket through grant completion
• canonical macOS Lume harness on the final candidate SHA before ready-for-review

diff scope

The final diff touches five files with 194 insertions and 278 deletions. Most deleted lines are the old re-exec state machine. No daemon protocol or MCP proxy types change.

known gaps

The draft has focused compile, routing, gate, and helper-entry coverage. It remains draft until the destructive TCC-reset reproduction is run in a disposable logged-in macOS environment and the canonical Lume harness certifies the final candidate.