feat(client): route local frontends through the daemon service

[arcuru-bot]

Summary

• route usage, cmd, TUI, and --print through the daemon-hosted Eidetica service with detached autostart and no direct-open fallback
• keep the daemon as the sole embedded-backend, sync, routine, and local agent-runtime owner while Matrix remains a separate peer
• preserve queued and scheduled writes, relay persisted TUI approvals, and publish hosted-entity catalogs to service clients
• add deterministic concurrent frontend, lifecycle, ownership, approval, cleanup, and Matrix service-path coverage

This is the second layer of the stack above arcuru#59. GitHub cannot use a cross-repository PR head as a base branch in arcuru/chaz, so this layer targets arcuru-bot/chaz:feat/eidetica-service-socket, the exact head branch of arcuru#59. After arcuru#59 lands, this branch can be retargeted into arcuru/chaz:main without changing its delta.

This layer also depends on arcuru/eidetica#108, pinned by exact revision. That fix makes a service-client database open use the caller-proven per-database identity for its initial root probe instead of the connection login identity.

Verification

• focused Eidetica service regression: 2 passed, including rejection of an unheld key; reverting the fix reproduces the former PermissionDenied
• Eidetica full Nix gate: build, doc, eval, lint, test, and treefmt; in-memory matrix reports 1405 passed, 4 skipped
• Chaz focused pending-turn and follow-up tests pass
• local frontend E2E: all 8 checks pass, including concurrent daemon-owned turns and sole-opener enforcement
• Matrix E2E: cold boot, copied-state recovery, bridge/daemon restart, group-room routing, and ReAct cases pass
• Chaz full Nix gate: test derivation reports 67 + 1030 + 11 + 19 passed, 0 failed

Dependency graph

1. fix(database): open a remote database as the per-database identity arcuru/eidetica#108 — correct per-database identity at the service root probe
2. feat(daemon): serve eidetica through a local socket arcuru/chaz#59 — daemon-owned local Eidetica socket and autostart machinery
3. this PR — local frontend cutover and daemon-only runtime ownership

Do not merge this PR before both dependencies.