feat(daemon): clap owns the command line, and one name per knob

Four things Indy called out, and the coverage blocker they turned out to be
sitting on. Lines go 98.37% (4274/4345) to 100.00% (4352/4352) with nothing
named in codecov.yml as an exemption.

**The hand-rolled CLI is gone.** `serve_args.zig` parses `--port` out of argv
by hand because Zig ships no argument parser; that loop was transliterated into
Rust, which does. The result was a daemon that read `argv[1]`, matched two
string constants, and took its port from the environment only — so `--port`,
`--help` and `--version` were all missing, and a usage error and a boot refusal
were the same exit code. `clap` restores every one of them: `--port N` and
`--port=N` (both spellings `parseArgs` hand-branched), port 0 refused as it was
in Zig, unknown input exiting 2 rather than 1. `PORT` survives as a `clap` env
FALLBACK, which means it is documented in `--help` instead of being the only
undocumented input path there was.

`--port` is proven at the process boundary, not just at the parser:
`test_the_port_flag_beats_the_environment` spawns the daemon with both set and
asserts the environment's port is DEAD. A daemon that bound both would pass an
assertion that only checked the flag's port answered.

**That is also what closed the coverage gap.** All 71 uncovered lines were in
`main.rs`, `serve.rs::run` and `migrate.rs` — unreachable because a binary
crate's internals cannot be linked by an integration suite. Parsing, dispatch,
runtime construction and the shutdown signal now live in `cli.rs` and
`signal.rs`, and `main.rs` is 33 lines that run on EVERY invocation. Two seams
made the last arms reachable, both following `serve_accepts`'s precedent of
injecting the thing that will not fail on demand:

  - `RuntimeSource` is a `fn` pointer, so "the runtime would not build" is a
    test rather than a hope.
  - `stop_on` takes the SignalKind, so the degraded path — SIGTERM would not
    register, SIGINT alone still stops us — is reachable through the same
    public call production uses. `SignalKind::from_raw(SIGKILL)` fails to
    register; a real SIGTERM never does.

**A latent CI flake, found by it.** `hub/pump.rs:118` — a SUBSCRIBE failing on
a dying socket — was covered only when `integration_hub`'s reconnect test won a
race. It lost on one run here and took the gate to 99.98%. It now has a
deterministic twin against the fake Redis, beside the UNSUBSCRIBE case that
already had one, and costs 0.21s with no live service. A line whose coverage
depends on winning a race is a line nobody has tested.

**One name per knob.**

`AFD_GIT_COMMIT` is deleted. `make/build.mk` already computed `GIT_COMMIT` and
already tagged images with it; the prefixed second name was never set, so a
container build tagged `:VERSION-abc1234` while the binary inside reported
`"commit":"unknown"` — no `.git` in the build context, and nothing bridging the
two. `build.mk` exports it and `build.rs` forwards it explicitly rather than
relying on `option_env!` inheriting it, because a stamp that depends on how the
compiler was invoked is right until someone wraps the build.

`RUSTD_RESOLVE_DB_URL` is deleted. It was a shell macro picking between a
`_LOCAL` default and a bare override hook nothing ever set, re-appending an
`sslmode` the default already carried, and handing the result to cargo under a
fourth `AFD_`-prefixed name: one value, three names, and a resolver whose only
live branch was "use the default". `?=` plus `export` is the make idiom that
already means that. Three names now — `TEST_DATABASE_URL`, `TEST_REDIS_URL`,
`TEST_REDIS_CA_CERT` — read directly by the suites.

**The error standard's open list is empty.** All three items it named as not
yet done are done, and `agentsfleetd` is added, which it had not named:

  - `afd_auth::AuthError` -> `afd_auth::Error`; the stutter is gone.
  - `afd_identity` gains `error.rs`. `BlankSecret` was a unit struct exactly
    one function returned and nothing matched on, so it is a variant of `Error`
    now. `ClaimUnavailable` stays a type, because `UnknownSubject` is
    deliberately NOT an outage and the caller must discriminate on it.
  - `afd_state` gains `error.rs` that records why it owns no error: it
    implements `afd_auth`'s `CredentialDirectory` and `CapabilitySource`, whose
    signatures mandate `Unavailable`. A crate implementing a foreign trait does
    not choose the trait's error type.
  - `agentsfleetd` gathers `Fault`, `Refusal`, `BootFailure` and
    `MigrateFailure` from three files into `error.rs`, re-exported at their old
    paths. It keeps TWO terminal errors because they cannot be merged: both
    compose `afd_db::Error` by `#[from]`, and one enum cannot carry two
    variants deriving `From<afd_db::Error>`. That is a compiler fact, not a
    preference, and it is written down where the next reader will look.

`afd_api`, `afd_observability` and `afd_wire` owe nothing — no fallible
function between them. `FailureClass` is a serde field on the wire `Failure`
payload, not a Rust error.

Verified: `make harness-verify` green over the real 39-file staged scope,
`make lint-all`, `make test-unit-all`, `make check-version` (0.26.2), and
`make test-coverage-rustd` at 613 tests / 100.00% lines.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>