fix(cua-driver): authenticate history requests lazily

[injaneity]

summary

• keep cheap peer identity capture at connection acceptance
• select a peer for full Computer History attestation only after parsing history_control or history_relaunch_state
• run blocking signature verification outside the async worker
• apply the same request-scoped rule to Unix sockets and Windows named pipes

root cause

#3347 established that 0.21 moved installed-helper attestation into the macOS Unix-socket accept loop. The exact installed helper then ran five synchronous codesign subprocesses before the daemon knew the request method. status --socket performs a liveness request followed by authorization_status, so both ordinary connections paid the privileged History cost and the accept loop could not serve another client while attestation ran.

scope

This keeps the existing peer path and signature checks unchanged. It separates cheap peer identity capture from expensive verification and selects verification only for the two privileged History methods. It does not add a cache or change status, which overlaps #3318.

The issue reporter supplied the cross-version isolation and identified the eager attestation path that this change corrects.

Fixes #3347.

validation

candidate: 6cf704eef66b1f30ac7befe0771a935ac94f113d

completed:

• cargo fmt --all -- --check
• git diff --check
• deterministic routing coverage proves only the two History methods select the peer for verification and missing peer identity fails closed
• existing forged-CLI refusal coverage retained
• Linux, Windows, and Nix Rust unit and compile checks passed
• portable contract parity passed on macOS, Windows, and Linux
• non-publishing cross-platform packaging passed, including both macOS architectures and the universal app bundle: https://github.com/trycua/cua/actions/runs/33703512759
• all ordinary pull request checks passed

pending:

• exact installed macOS reproduction proving status --socket avoids codesign and completes below the downstream 2-second deadline
• exact-candidate macOS Cua Driver E2E before readiness

local focused Rust execution remains unavailable because this Linux workspace lacks pkg-config and X11 development metadata.