feat(core-rs): add secure local control transport

[SarthakWade]

Summary

• add a platform-neutral Rust control connection and listener seam with bounded newline framing
• add validated, response-correlated request exchange with typed transport failures
• add a secure Unix-domain socket backend with private runtime permissions, safe stale endpoint handling, and peer UID authorization
• document roadmap progress while keeping Windows named pipes and SID authorization explicitly out of scope

Security

• preserves the no-TCP control-plane contract
• requires a real current-user runtime directory with no group or other permissions
• creates the runtime directory as 0700 and the socket as 0600
• rejects non-socket, foreign-owned, and live endpoints before cleanup
• authenticates accepted peers before request decoding
• bounds reads and writes to the existing 1 MiB protocol limit

Validation

• cargo test --locked
• cargo clippy --locked --all-targets -- -D warnings
• Windows and macOS Rust cross-target clippy
• pnpm test
• pnpm test:runtime
• pnpm test:npm
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• ./apps/headless/build.sh
• static shell, checksum, whitespace, and npm package checks
• pnpm test:e2e:linux

Closes #140