fix(daemon): harden bounded per-source registry races

Stamp host_last_use before publishing a bucket key and treat an unstamped
(last_use == 0) bucket as live, so a just-claimed bucket can no longer be
stolen by a concurrent reclaimer.

After a successful eviction CAS, re-scan for the interned key and, when an
earlier bucket already holds it, zero the duplicate's active count and
return the canonical bucket, preventing orphaned per-host counts and cap
overshoot under full-table concurrency.

Add a message-carrying EXPECT_FAIL primitive and use it for the daemon-conf
buffer-overflow guard, and add a fork-based test that records auth failures
from forked children and asserts the parent observes the shared lockout.

tests/test_daemon_conf.c

@@ -550,7 +550,7 @@ static void test_daemon_conf_module_count_capped() {
     int n = snprintf(line, sizeof(line), "[m%zu]\npath = /x\n", i);
     if (n < 0 || (size_t)n >= sizeof(line) || used + (size_t)n >= len) {
       free(body);
-      EXPECT_TRUE(0 && "module-count test buffer overflow");
+      EXPECT_FAIL("module-count test buffer overflow");
       return;
     }
     memcpy(body + used, line, (size_t)n);