fix(mcp): harden daemon discovery — identified PONG, port scanning, version takeover, resident-by-default

[StefanSteiner]

Summary

Hardens the hyperdb-mcp single-instance daemon so clients can't mistake a
foreign process for the daemon, the default health port stops colliding with
hyperd's gRPC port, upgrades take effect immediately, and the daemon (plus the
hyperd it owns) stays resident — eliminating the "hyper is restarting, please
retry" round-trip clients hit after an idle shutdown.

Resolves #114.

Background

The daemon advertises a TCP health port in ~/.hyperdb/daemon.json that serves
as both a single-instance lock and a control channel. Four problems motivated
this work:

1. Weak liveness check. discover() trusted a bare TCP connect() to the
   health port and never sent PING — any process camped on the port read as a
   live daemon.
2. Collision-prone default port. The default was 7484, which is hyperd's
   conventional gRPC port (ListenMode::Both { grpc_port: 7484 }) — exactly the
   kind of process that triggers problem 1.
3. Slow upgrades. A newer client silently reused an old daemon; the stale
   hyperd lingered until the 30-min idle timeout.
4. Restart-churn UX. On idle timeout the daemon killed hyperd; the next
   client hit a connection error surfaced as "hyper restarting, retry."

Changes

• Identity-checked discovery. PING now replies PONG hyperdb-mcp <version>.
  Clients verify the exact tokens (not a string prefix) before trusting a daemon;
  is_daemon_alive uses this instead of a bare TCP connect. A process that
  answers TCP but not the identified protocol is classified as "camped" and
  skipped; a stale/foreign daemon.json is detected and removed.
• Port scanning. Default base port is now 7485 (away from hyperd gRPC).
  resolve_port_scan() returns a PortScan { base, span }: pins the exact port
  when HYPERDB_DAEMON_PORT is set, else scans 16 ports upward. probe_port
  classifies each as OurDaemon / Camped / Refused; the daemon spawns on the
  first refused port. daemon status / daemon stop locate the daemon via
  discovery + scan (CLI --port is now optional).
• Newer-client version takeover. A starting client whose semver is strictly
  newer STOPs the old daemon (which drops its HyperProcess, stopping hyperd),
  waits for the port to release, and respawns on the same port. Equal / older /
  unparseable versions reuse the daemon — never a downgrade-kill.
• Resident by default. DaemonConfig.idle_timeout is now Option, set only
  via --idle-timeout / HYPERDB_DAEMON_IDLE_TIMEOUT (flag wins over env). With
  neither set the idle monitor never arms; the daemon and hyperd stay warm. The
  hyperd restart-limit shutdown (3 failures / 60s) is unchanged.
• status tool surfaces the endpoint. New engine block: mode
  (daemon/local), hyperd_endpoint, and daemon_health_port — previously
  only reachable via ~/.hyperdb/daemon.json or hyperdb-mcp daemon status.
• Heartbeat correctness fix. The server heartbeat previously re-resolved the
  port, which would target the wrong port under scanning; the engine now records
  the discovered health_port and the heartbeat uses it.

Decisions

• HYPERDB_DAEMON_PORT set ⇒ pin that exact port (no scan).
• Scan tuning: 16 ports from 7485, 300ms connect/read per probe.
• Version takeover only on strictly-newer semver (two builds of the same version
  — e.g. dev rebuilds — are equal and won't take over; use daemon stop to force).
• Old/foreign daemon failing the identity check ⇒ delete stale daemon.json,
  re-spawn.

Known tradeoff

Resident-by-default removes the idle timeout that used to implicitly reap a
hung-but-alive hyperd. Such a daemon now stays wedged until a client reports
an error (REPORT_HYPERD_ERROR, fired on client-side ConnectionLost) or an
operator runs daemon stop. Documented in DEVELOPMENT.md; a future daemon-side
liveness probe could close the "all clients idle + hyperd hung" gap. See #114.

Testing

• New unit tests: identified-PONG accept / reject-foreign / reject-refused /
  reject-token-lookalike; resolve_port_scan pin-vs-scan; scan
  finds-via-STATUS / skips-camped / all-refused; client_should_take_over
  version matrix; DaemonConfig::from_args none/flag/env/precedence; status
engine block.
• cargo test -p hyperdb-mcp green; cargo clippy --workspace --all-targets -- -D warnings clean; cargo fmt --all --check clean; cargo deny check clean
  (adds semver as a direct dep, already in the lock).
• Verified end-to-end against a rebuilt MCP: status reports
  engine.hyperd_endpoint and daemon_health_port: 7486 (scanner correctly
  skipped an occupied 7485), version stamp matches the branch HEAD.

Docs

README (Operating Modes + CLI reference), DEVELOPMENT.md (daemon internals +
tradeoff), CHANGELOG Unreleased. Wiki: new [Shared Daemon] page.