feat(security): implement platform-specific security for macOS and Windows

[mpyw]

Summary

• Implement macOS peer credential verification using LOCAL_PEERCRED via raw syscall
• Implement macOS core dump prevention using setrlimit(RLIMIT_CORE, 0)
• Implement Windows minidump prevention using SetErrorMode
• Document Windows AF_UNIX limitation (no peer credentials, relies on ACLs)
• Fix memguard usage: use WipeBytes() for cryptographically secure zeroing
• Unify Linux peer verification to use SyscallConn (same as macOS) to avoid connection disruption
• Add comprehensive tests for all platforms

Platform Support

Platform	Peer Verification	Core Dump Prevention
macOS	LOCAL_PEERCRED (raw syscall)	setrlimit(RLIMIT_CORE, 0)
Linux	SO_PEERCRED (GetsockoptUcred)	prctl(PR_SET_DUMPABLE, 0)
Windows	No-op (relies on socket ACLs)	SetErrorMode(SEM_*)
Other	No-op	No-op

Test plan

• All existing tests pass
• New peer verification tests (darwin/linux/windows)
• New process security tests (darwin/linux/windows)
• Lint passes
• CI passes on all platforms

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 52.30769% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.28%. Comparing base (3f0631f) to head (73e2264).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
...tore/agent/internal/server/security/peer_darwin.go	55.26%	10 Missing and 7 partials ⚠️
...store/agent/internal/server/security/peer_linux.go	44.44%	6 Missing and 4 partials ⚠️
...aging/store/agent/internal/protocol/socket_unix.go	0.00%	2 Missing ⚠️
...e/agent/internal/server/security/process_darwin.go	60.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #106      +/-   ##
==========================================
- Coverage   90.70%   90.28%   -0.42%     
==========================================
  Files         122      131       +9     
  Lines        7339     7415      +76     
==========================================
+ Hits         6657     6695      +38     
- Misses        475      502      +27     
- Partials      207      218      +11     

Flag	Coverage Δ
e2e	66.71% <38.09%> (-0.04%)	⬇️
platform-darwin	64.44% <54.34%> (?)
platform-linux	62.85% <42.85%> (?)
platform-windows	73.46% <100.00%> (?)
unittests	80.98% <42.85%> (-0.08%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.