why

• this PR strengthens runtime directory validation before daemon communication in browse

what changed

• require directories owned by the current user, including when running as root
• reject symlinks and non-directory paths

test plan

• added regression coverage for directory validation and daemon connections

---

Summary by cubic

Harden daemon runtime directory validation in browse so the CLI never connects to a socket or modifies files in an unowned, symlinked, non-directory, or unsafe-parent path. Previously, a custom BROWSE_DAEMON_DIR could point anywhere and the client would connect and forward credentials before checking; now every client entry point (status, stop, open, and driver commands) validates the directory first and propagates the error instead of cleaning up stale daemon files.

Behavior

• Requires the runtime directory and every parent to be owned by you or root; shared writable parents need sticky-bit protection, as standard /tmp provides. These checks also apply when TMPDIR changes the default location.
• Rejects empty and dangling paths, symlinks, and non-directories before any socket connection, chmod, or lock operation, including ancestor symlinks whose targets are unsafe.
• Revalidates ownership between lock and cleanup steps instead of trusting an earlier probe.
• Adds regression coverage for all client entry points, root and unprivileged callers, and ancestor permission and symlink cases.