feat(tui): add Stop daemon action to Settings dialog (F1)

[artyomsv]

Summary

Adds a "Stop daemon" action row to the Settings dialog (F1 → Settings → ↓ to last row). Pressing y on the confirmation cleanly stops the daemon and quits the TUI in one step — the daemon's stop defers (final snapshot write, PID file removal, log close) all run before the TUI exits, so panes respawn cleanly from the snapshot on next launch.

Closes the operator gap where stopping the daemon from inside Quil meant either (a) opening a fresh terminal to run quil daemon stop, or (b) finding the PID and killing it manually.

UX

F1 → Settings → ↓×7 to "Stop daemon"
> Stop daemon              (closes this TUI window)

Enter → confirmation dialog:

  Stop the daemon?

  This TUI window will close.
  Panes will respawn from the snapshot on next launch.

  y confirm    Esc cancel

• y accepts → MsgShutdown → tea.Quit, all in the same handler return
• Enter is a deliberate no-op for this confirm. Enter is the universal Settings-toggle commit key; reserving it from the shutdown confirm prevents finger-memory misclicks from killing the daemon and every pane child.
• Esc returns to Settings with the cursor restored to the Stop daemon row (via label lookup, not positional).

Implementation

• settingsField.action func(Model) (Model, tea.Cmd) — new optional field. When set, Enter on Settings calls the action instead of opening the inline editor. The existing get/set/isBool wiring is untouched for the other seven config rows.
• confirmKindShutdown — typed const so the handler and renderer cannot drift on a typo.
• Synchronous Send + tea.Quit — the IPC MsgShutdown send is inline in handleConfirmKey. By the time the runtime sees tea.Quit, the daemon has the message. This deliberately rejects the original tea.Batch(send, tea.Quit) design because Batch runs commands concurrently with no ordering guarantee — under Batch, main.go's defer client.Close() could race the in-flight send and the daemon could miss the shutdown message. The IPC client is a ~150-byte write to a local Unix socket, so inlining has no UI-thread concern.
• tuiClient interface — Model.client was *ipc.Client (concrete). Extracted a one-package interface (Send + Receive) at the consumer so the new Enter-path tests can inject a fakeSender. *ipc.Client satisfies the interface implicitly, so the assignment in NewModel and every existing call site is unchanged.
• Width bump — dialogWidth 50 → 60. The "(closes this TUI window)" description wrapped in the prior width; the confirm body line "Panes will respawn from the snapshot on next launch." (~52 chars) wrapped too. Matched to the existing disclaimerWidth = 60.

Files

File	Change
internal/tui/dialog.go	settingsField struct + Stop daemon row + handleSettingsKey action dispatch + handleConfirmKey shutdown branches (Esc + y) + renderConfirmDialog per-kind footer + stopDaemonRowIndex() + confirmKindShutdown const + dialogWidth 50→60
internal/tui/model.go	tuiClient interface; Model.client field type lift from *ipc.Client to tuiClient
internal/tui/dialog_test.go	9 tests: field-shape guard, Enter-routing, Esc-returns-to-Settings, render-message-contents (positive + negative for "y confirm"), Enter-is-no-op, y-sends-and-quits (with fakeSender), y-with-send-error-still-quits, y-with-nil-client-still-quits, plus the existing tests with t.Parallel() added
internal/claudehook/claudehook.go	One-line backport: cleanup-comment improvement on os.Remove discard (consistency win, no behaviour change)
.claude/CLAUDE.md	Settings dialog persistence section updated to document the action-row mechanism, the y-required confirm, and the synchronous-Send rationale
CHANGELOG.md	[Unreleased] / Added entry

Daemon-side: zero changes. Existing MsgShutdown handler at internal/daemon/daemon.go already writes the final snapshot via stop defers.

Hardening applied during review

A /code-review pass on the initial commit surfaced 6 medium + 14 low findings. Every actionable item is addressed:

• Critical — tea.Batch race fixed by inlining the Send
• Critical — Enter-path coverage gap filled by the tuiClient interface + 3 new tests
• Security — y required instead of Enter (prevents finger-memory misclicks)
• Code quality — Esc cursor restore is now stopDaemonRowIndex() (label-lookup, not positional)
• Rules — req, _ := ipc.NewMessage(...) matches the file's structural convention
• Rules — t.Parallel() added to all tests in dialog_test.go
• Rules — Bespoke contains test helper dropped in favour of strings.Contains
• Test honesty — stop.get(&Model{cfg: config.Default()}) instead of stop.get(nil)
• Negative assertion — render test now also fails if "Enter confirm" reappears in the shutdown confirm footer

Test plan

• go vet ./... — clean
• go test ./... (full suite, 17 packages) — green
• go test -race on internal/tui/ and internal/ipc/ — clean
• GOOS=windows go build ./... — clean (confirms the tuiClient interface lift didn't break Windows)
• Daemon-lifecycle smoke (native arm64 dev build):
  • ./quild-dev --background starts cleanly
  • ./quil-dev daemon stop (same MsgShutdown wire the new F1 action uses) → daemon log: ipc recv: shutdown → shutting down (IPC) → final snapshot written → pane children reaped
  • PID file + socket cleaned up
  • Workspace snapshot persisted on shutdown

The interactive TUI smoke (F1 → ↓×7 → Enter → confirm "y confirm" footer → press Enter, observe no-op → press y, daemon stops, TUI exits) was verified manually on macOS arm64.

Caveats / deferred

• confirmKind asymmetry — promoting the other three string discriminators ("pane", "tab", "instance") to typed consts touches multiple files outside this feature; deferred to a follow-up
• dialog.go size (2511 lines) — tech debt noted; split-by-dialog-type refactor would land once a techdebt/ directory is established
• settingsField sum-type split (separate editor vs action variants) — over-engineering for two action rows today; re-evaluate when a third appears