fix(daemon): restore blocking I/O before client authentication

[ractive]

Accepted daemon client sockets can inherit the listener’s nonblocking mode on macOS. A captured failure rejected authentication about88µs after handler entry, before the client finished sending it; the resulting reset was presented as “timeout after auth.” The dedicated handler now restores blocking mode before creating its read/write halves, allowing the existing deadlines to govern I/O. Authentication, timeout values, and retry policy are unchanged.

The regression explicitly starts with a nonblocking socket and delayed authentication: it fails before the fix and passes afterward, verifies the greeting, and joins the handler. Actual failed connection timing and successful socket-mode controls are retained. Older timeout/EOF/reset observations are preserved without claiming universal attribution; iteration268 remains open.

Validation: focused auth regressions; final-source original160/recurring165 real-Firefox tests; ordered stable-update/fmt/strict workspace clippy/workspace tests; all nine xtask checks (dogfood explicitly skipped: no script). Independent Astra review found no product-code/security/substantive-evidence issues; one carry-over reference corrected. Main’s independent265 change was reconciled with hashes unchanged and combined-tree ordered gates verified.

The dual-gate sweep (FF_RDP_LIVE_TESTS=1 FF_RDP_LIVE_NETWORK_TESTS=1) retained this actual summary on the267 baseline:

LIVE_SWEEP_SUMMARY executed=335 skipped=0 preexisting=9 vanished=0 launch_timeout=0 timed_out=0 total=344
LIVE_SWEEP_PROFILES leaked=0 unattributed=0 root=/Users/james/Library/Application Support/ff-rdp/profiles

CLI334passed/1failed. The raw browser exited before sweep startup; the exact nine omitted core tests subsequently passed in a separate dual-gate run. All344 unique names reconcile as343passes/1failure across those separate runs. Main’s two265 Watcher tests have their independently reviewed live evidence inPR257; no invented combined sweep summary.

Carry-over: external-CSS cascade test returned no element matching selector h1; an unchanged-source isolation passed2.66s and does not explain the failure. Filed plan276 retains the missing document/route evidence; it is outside the selected execution queue. No full-green sweep claim. Iteration267 fulfills4/4 original criteria for its demonstrated occurrence.