Before runtime.init(), the daemon now downloads kernel/rootfs if not
cached and copies the agent binary from the boot cache. The setup phase
is set to DOWNLOADING_ASSETS during the download so desktop clients can
show progress.

Spawn a non-blocking task in the recovery phase that installs docker,
buildx, compose, and credential-helper from assets.lock if not already
present. Sets docker_tools_installed on SetupState when done.

Download kernel/rootfs and runtime binaries as step 4/6 of the install
flow so the daemon can cold-start without network access.

Auto-detect "Developer ID Application: ArcBox, Inc." from keychain.
Ad-hoc signing (-s -) doesn't work with Virtualization.framework on
recent macOS — the process gets SIGKILL'd.

New targets:
- sign-daemon: build + Developer ID sign arcbox-daemon
- sign-all: build + sign all three binaries
- verify: inspect signing status of all binaries
- sign: kept for CI smoke tests (ad-hoc only)

DNS resolver, Docker socket, boot assets, and runtime binaries are all
handled by the daemon's self-setup and startup provisioning. The install
command now only does what requires sudo (helper installation) plus
daemon LaunchAgent registration for CLI-only users.

Also removes the arcbox-helper dependency from arcbox-cli since no
commands use the helper tarpc client directly anymore.

Rename to `_install` / `_uninstall` with `hide = true`. These are
implementation details consumed by brew postinstall and DMG installers,
not user-facing commands. The daemon self-provisions everything users
need on first start.

Two-phase startup:
1. init_early: directories, config, sockets → start gRPC with
   SystemService only → clients can observe DOWNLOADING_ASSETS phase
2. init_runtime: seed/download boot assets, build runtime, start VM →
   abort early gRPC, restart with all services

Bundle seeding: when running inside an app bundle, the daemon copies
boot assets from Contents/Resources/assets/{version}/ to the cache
before attempting CDN download. This makes first launch offline-capable
when assets are bundled in the DMG.

DaemonContext.runtime is now Option<Arc<Runtime>>, accessed via
runtime() which panics if called before init_runtime.

seed_from_bundle() now copies all assets from the app bundle:
  - Contents/Resources/assets/{version}/ → ~/.arcbox/boot/{version}/
  - Contents/Resources/runtime/          → ~/.arcbox/runtime/
  - Contents/Resources/bin/arcbox-agent  → ~/.arcbox/bin/arcbox-agent

ensure_docker_tools() passes Contents/MacOS/xbin/ as bundle_dir to
DockerToolManager, so docker/buildx/compose/credential-helper are
installed from the bundle before falling back to CDN download.

This makes the first launch from DMG fully offline-capable.

New helper RPC methods create/remove symlinks in /usr/local/bin/ for
Docker CLI tools, pointing into the app bundle's Contents/MacOS/xbin/.
Strict validation: only allowed tool names, target must be inside an
.app bundle, no path traversal.

The daemon's self-setup now includes a CliTools task that runs after
DNS/socket setup, creating symlinks like:
  /usr/local/bin/docker → ArcBox Desktop.app/Contents/MacOS/xbin/docker

This gives desktop users system-wide `docker` access without manual
PATH configuration, matching Docker Desktop / OrbStack behavior.

Service impls now hold Arc<OnceLock<Arc<Runtime>>> instead of
Arc<Runtime>. RPCs return UNAVAILABLE while runtime is not set.
This eliminates the gRPC server restart — a single server runs from
boot, and Machine/Sandbox services become available once init_runtime()
fills the OnceLock.

Fixes: Desktop gRPC client losing connection when server restarts.

- Fix pkill pattern: ArcBoxHelper → arcbox-helper
- Remove helper binary, plist, and socket after bootout
- Remove /usr/local/bin/docker* symlinks created by cli_link

Move shared constants to arcbox-constants/src/paths.rs:
- privileged::{HELPER_BINARY, HELPER_PLIST, HELPER_SOCKET, DOCKER_SOCKET}
- labels::{DAEMON, HELPER}
- DOCKER_CLI_TOOLS (single source of truth for docker/buildx/compose/credential)

Update all consumers:
- install.rs: use privileged:: constants
- uninstall.rs: use privileged:: + DOCKER_CLI_TOOLS
- validate.rs: use DOCKER_CLI_TOOLS from constants
- cli_tools.rs: use DOCKER_CLI_TOOLS from constants
- docker_socket.rs: use privileged::DOCKER_SOCKET
- socket.rs (helper): use privileged::DOCKER_SOCKET
- lib.rs (helper): derive HELPER_SOCKET from constants

Fix stale comment in self_setup.rs referencing old `sudo arcbox install`.

- Add unit tests for validate_cli_name/validate_cli_target
- Handle shared_runtime.set() double-call as error, not silent drop
- Remove unused OnceLock import in context.rs
- cli.rs link(): only replace ArcBox-owned symlinks (check .app/Contents/MacOS/xbin/)
- cli.rs unlink(): use same strict ownership check
- uninstall.rs: match ownership check pattern
- Gate CLI symlink creation behind docker_integration flag
- cli_tools.rs is_satisfied(): verify symlink points to current xbin_dir, not just "ArcBox"

- Makefile: pass SIGN=0 to rebuild-run-daemon.sh (avoid double-sign)
- startup.rs: run seed_from_bundle in spawn_blocking (avoid stalling tokio)
- validate.rs: restrict cli_target to /Applications/ or /Users/ (prevent
  fake .app paths in /tmp); add test for /tmp/evil.app rejection
- mod.rs + main.rs: gate _uninstall behind #[cfg(target_os = "macos")]