feat(tsmd): idle-quit daemon when locked and silent for 30 minutes

[tashian]

Summary

• Daemon shuts itself down when the vault is locked AND no RPC has arrived for idleQuitSeconds (default 1800). The next tsm command spawns a fresh daemon from whatever binary is on disk, so upgrades land automatically once the user has been idle long enough.
• Reverts the shim-side staleness check from feat(npm): restart stale tsmd in the shim, not postinstall #12. That approach had a correctness gap on bun install -g: bun overwrites the binary in place, so the running daemon's argv[0] matches the post-upgrade path and the path-mismatch heuristic skips it. Idle-quit covers in-place upgrades, cross-prefix upgrades, and any future install method without a wrapper-side opinion.
• Tradeoff: between the upgrade and the idle window, clients keep talking to the old code. tsm daemon stop is the escape hatch when that matters.

Implementation

• New IdleTracker actor in tsmd/ — tracks lastActivityAt, exposes bump() and isIdle(idleSeconds:now:).
• JSONRPCHandler bumps the tracker on every request (errors and unknown methods included — they're still client activity).
• Daemon owns the tracker, exposes shouldIdleQuit(), and the existing 15 s tick now evaluates the predicate and posts .tsmdShutdown when it fires.
• Daemon.init grew injectable vault / idleTracker / idleQuitSeconds / tickInterval parameters with defaults that preserve production behavior, so tests can drive Daemon.run() to completion in milliseconds.

Test plan

• swift test — 123 pass / 0 fail (added 13 tests: 6 IdleTrackerTests, 5 DaemonIdleQuitTests including a real Daemon.run() round-trip that verifies the full timer → notification → shutdown → socket-unlinked chain, 2 handler bump tests)
• go test ./... — all packages pass
• Manual: install via bun, observe a real tsmd, lock vault, leave it for 30 min idle, confirm process exits and socket file is gone
• Manual: confirm tsm daemon stop still works as the immediate escape hatch