fix(cli): recover macOS vault daemons without a connection race

[nkavian]

Summary

Fix intermittent write EPIPE failures when switching between the Homebrew and development CLI on macOS.

• Identify the process owning the listening vault socket without opening a connection that an incompatible daemon can immediately reject.
• Require same-user ownership, a protected socket directory, an unambiguous listener, and the existing daemon-recognition checks before shutdown.
• Include regression coverage for immediate disconnects and unsafe or ambiguous listener identities, plus a patch changeset.

Authentication checks and Linux and Windows recovery behavior remain unchanged. No retry loop or daemon close delay is introduced.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!