fix: prevent sibling shim daemon crash loops

[muqsitnawaz]

Outcome

Fixes RUSH-1527 by ensuring daemon auto-starts from the installed browser and computer sibling shims invoke the canonical agents daemon _run entrypoint instead of recursively invoking a shim that does not implement daemon.

Headless daemon startup now reads only the already-unlocked secrets-agent snapshot. It does not trigger an unanswerable Keychain biometric prompt when no TTY is present.

This replaces #878, rebased cleanly onto the current default branch after #876 merged.

Verification

• bun run build
• bunx vitest run src/lib/daemon.test.ts src/lib/secrets/bundles.test.ts
• Result: 2 test files passed, 39 tests passed.
• Installed macOS launchd verification will be posted on this PR from the exact head commit before merge.

User-visible documentation

• Updated the existing CLI changelog with the daemon-startup behavior fix.

Session evidence

Public repository: transcript intentionally omitted. Fleet-local transcript: zion:/Users/muqsit/.codex/sessions/2026/07/10/rollout-2026-07-10T16-41-07-019f4e68-044c-7872-977c-0f748562dc06.jsonl.

[muqsitnawaz]

Exact installed-artifact verification on mac-mini (head 379b744a2b84cbaa0c1251ede8ca0939292a3bb7):

installed_version=0.0.0-dev.379b744a
precondition=daemon-unloaded
Started task "rush1527-final-e2e" with tab 6b205498
ProgramArguments:
  /Users/muqsit/.local/bin/agents
  daemon
  _run
active count = 1
state = running
program = /Users/muqsit/.local/bin/agents
default@endpoint-0 (port 9222, pid 93183)
  rush1527-final-e2e  1 tab
Completed task: rush1527-final-e2e
cleanup=done

This is the real installed browser shim → launchd → daemon → live task flow, after explicitly unloading the daemon first.

[muqsitnawaz]

Independent fallback review completed after the configured reviewer did not post:

• Reviewer: Claude Opus 4.6 on mac-mini
• Session: 41791ef5-36b7-4ea9-998b-8b97924507bc
• Verdict: READY_TO_MERGE
• Independent targeted result: 39/39 tests passed
• Findings: no correctness, security, or compatibility issues
• Public repository: transcript omitted; fleet-local transcript: mac-mini:/Users/muqsit/.agents/.history/versions/claude/2.1.187/home/.claude/projects/-Users-muqsit--agents-repos-agents-cli-leftovers-w1--agents-worktrees-rush1527-verify/41791ef5-36b7-4ea9-998b-8b97924507bc.jsonl

[muqsitnawaz]

Post-merge installed-main verification (origin/main = b06409d1e33169c376d3fcb8c01e734e7fb40387):

installed_version=0.0.0-dev.b06409d1
Started task "rush1527-merged-main" with tab 53e2419d
ProgramArguments:
  /Users/muqsit/.local/bin/agents
  daemon
  _run
active count = 1
state = running
program = /Users/muqsit/.local/bin/agents
Completed task: rush1527-merged-main
rush1527_merged_main=passed