Remove the command-line fallback from socket owner resolution

[yummybomb]

Summary

Stacked on #363. Deletes pidByCmdline and the confirmed flag from socket owner resolution, collapsing classifyResolvedHypervisorOwner from an 8-branch matrix to 4 cases.

A command-line-only match could never authorize teardown — destructive paths already refused unconfirmed PIDs — so the fallback's only effect was distinguishing provable death from ambiguity. That distinction only matters if the fd scan can miss a live owner, which requires the caller to lack CAP_SYS_PTRACE. Hypeman runs as root (dev) or with a full capability set (prod), so the listener scan is authoritative: a confirmed owner is returned, a missing listener is proof the hypervisor is gone, and only a failed scan fails closed.

The fallback was also actively harmful: a debug client carrying the socket path in its argv (ch-remote, socat) resolved as a live unconfirmed match and wedged stop/delete with a 500 until the client exited. That case now correctly classifies as provable death and the bystander is never signaled.

Assumption made explicit: resolution correctness now depends on hypeman retaining ptrace-equivalent capabilities (root or CAP_SYS_PTRACE). This is documented on ResolveProcessPID. If the service is ever de-privileged below that, the fd scan can miss owners and this needs revisiting.

Testing

• go vet clean; go test -race ./lib/hypervisor/ ./lib/instances/ targeted identity/kill/shutdown/backfill suites pass locally (TestSocketCacheKeyChangesWhenSocketIsRecreated fails in this sandbox on the unmodified base too — inode reuse in /tmp)
• Same suites cross-compiled and run as root on a dev host with real /proc: all pass
• Live validation on that host: a real daemon control socket resolves to its owning PID; a dead socket path held in a live process's argv returns ErrNoOwningProcess instead of failing closed
• New/updated coverage: TestResolveProcessPIDIgnoresCommandLineBystander, TestKillHypervisorIgnoresCommandLineBystander, TestShutdownHypervisorIgnoresCommandLineBystander, reworked TestClassifyResolvedHypervisorOwner table

[yummybomb]

folding this into #363 directly — same review scope