fix: keep identity-proven live daemons in inventory

[schickling-assistant]

Fixes #161.

Why

When a live session lost its socket and pidfile but retained metadata, inventory ignored metadata.daemonPid and classified it as vanished. That made kill refuse the session and allowed gc to delete its last registry record while the daemon was still alive.

Blindly trusting the retained PID would be unsafe because the OS may have reused it for an unrelated process.

What

Keep the pidfile authoritative when present. When it is absent, accept the retained daemon PID only if its current OS process-start token exactly matches the token stored in recovery metadata.

That restores one consistent lifecycle identity for listing, kill, and gc without weakening PID-reuse protection.

Verification

• The real-daemon regression fails on 025a9034 because inventory reports vanished with pid: null.
• The fixed test removes the socket and pidfile, proves inventory remains running, proves gc retains the record and process, and then terminates it through the real kill command.
• An adversarial live-PID/mismatched-token control remains vanished and non-actionable.
• Focused lifecycle slice: 46 passed, 0 failed.
• TypeScript typecheck, docs verification, and nix build --no-link .#pty: passed.
• Full suite: 1569 passed, 20 skipped, 4 failed. An independent exact-parent run reproduced the same four environment failures by test name and signature (zsh startup, vim welcome, and two nano UI cases); the subject adds exactly two passing recovery tests.

Scope

The change is limited to inventory PID resolution, its recovery regressions, and the disk-layout description. It does not alter the full-absence pty recover protocol.