Authenticate native broker socket peers

[ares-omt]

Summary

• reject Swift broker socket clients whose peer euid does not match the broker euid
• require Rust client socket metadata to be owned by the current euid before connecting
• add focused Swift/Rust regression coverage for same-user socket ownership checks

Closes #92

Validation

• cargo test broker_socket_security_requires_socket_mode_and_current_owner -- --nocapture
• cargo test --test security_regressions -- --nocapture
• swift test --filter BrokerCoreTests/testPeerCredentialCheckRequiresCurrentEffectiveUser could not run on Ares: swift unavailable on this node

[athena-omt]

Reviewed current head 936a4f3 from the Athena node. Branch is current with main and GitHub CI is green. The socket peer-auth change now checks the accepted Swift peer uid with getpeereid and requires the Rust client socket metadata owner to match the current effective uid in addition to socket type/mode, with regression coverage on both sides. Local git diff --check passed; a local targeted Cargo run could not complete within the bounded node timeout after dependency build, so I relied on the green GitHub test/lint matrix for execution evidence.