fix(daemon): F-1 polish — token_path discovery, --help dispatch, stdo…

[chauncygu]

Four nits surfaced while smoke-testing F-1 (PR #80) on real subprocesses. None are blockers, but they each break a docs-promised path so they deserve a dedicated polish PR rather than getting buried in F-2's diff.

1. cheetahclaws daemon {status, stop, rotate-token} now read the token path from the discovery file when serve was started with --token-path. discovery.make_info() accepts a new optional token_path keyword (schema stays at 1 — additive); cli.cmd_serve() records it only when the path overrides the default; new commands.daemon_cmd._resolve_token_path() prefers discovery and falls back to the default location for old discovery files / unset case. Previously these verbs always read ~/.cheetahclaws/daemon_token, which silently created a different random token, then failed 401 against the running daemon.

2. python -m cc_daemon.cli --help (and the cheetahclaws spike-daemon --help backward-compat alias) now print a usage banner and exit 0 instead of unknown subcommand: --help / exit 2. The unknown- subcommand branch also includes the banner so users see how to recover. The PR description for feat(daemon): F-1 foundation — discovery, system methods, daemon CLI, health, e2e (on top of cc_daemon spike) #80 said the spike-daemon alias was "preserved" — this closes the gap.

3. The three serve-mode startup prints (token: …, cheetahclaws daemon listening on …, audit log: …) now flush=True so they appear immediately when stdout is redirected to a file under &. Previously they sat in Python's 4 KB block buffer until the daemon exited, silently breaking the spike-notes' --print-token > out.log & workflow because the token line never reached disk.

4. tests/e2e_daemon_skeleton.py::test_daemon_writes_discovery_and_token token-length floor raised from >= 32 to >= 40. secrets.token_urlsafe(32) yields ~43 chars, so the previous floor was loose enough that an accidental shrink to 16 raw bytes (~22 chars) would still ship green.

Tests: 10 new unit tests (4 covering cli.main dispatch, 4 covering _resolve_token_path, 2 covering discovery.make_info's new field). Full suite 669/669 passing on main. End-to-end smoke verified all three runtime fixes against cheetahclaws serve --listen tcp://....

Docs:

• README.md docs index — adds row for RFC 0002 (foundation roadmap); refreshes the spike row to reflect the actual landing path (feat(daemon): cc_daemon spike validating RFC 0001 contract end-to-end #77 → reverted → re-landed via Re-land cc_daemon spike for #80 (un-revert 3183fc6) Revert "Revert "Merge pull request #77 from SafeRL-Lab/feature/daemon… #81); marks F-1 as merged via feat(daemon): F-1 foundation — discovery, system methods, daemon CLI, health, e2e (on top of cc_daemon spike) #80.
• docs/RFC/0002-daemon-foundation-roadmap.md — F-1 status OPEN → MERGED #80.
• docs/architecture.md — daemon section now mentions the optional token_path discovery field and notes that the daemon-control verbs use it.
• docs/news.md — May 2, 2026 entry covering the spike re-land and F-1 merge sequence, the polish nits, and the intentional "not in F-1" list (agent.run, bridges, SQLite, cost guardrails, agent-runner subprocess, macOS peer-cred).

Refs #68, #74, #80, #81