secrets: host the broker inside the daemon (socket-first), retire the standalone service

[muqsitnawaz]

Part of the secrets-broker-in-daemon work (ADR docs/08, see #413). Supersedes the standalone com.phnx-labs.agents-secrets-agent launchd service shipped in 1.20.20.

Do:

• Host the secrets broker in runDaemon() next to BrowserIPCServer; bind the broker socket FIRST, before browser/session-sync init, so secrets resolve within ms of daemon start.
• ensureAgentRunning ensures the daemon is up (it owns the broker), not a separate process.
• Retire com.phnx-labs.agents-secrets-agent; secrets start/stop become thin daemon-lifecycle aliases or are removed.
• Migration: on upgrade, launchctl bootout the old secrets-agent service and let the daemon take over the socket.