fix(d5-daemon-core): cppcheck const-correctness, wire module length cap, daemonize chdir/umask, daemon confinement tests

- daemon_conf.c/server.c/test_daemon_conf.c: const-qualify parse/loop pointers;
  scope user_path static inside its block (clears the 9-wave-A cppcheck findings)
- config.c receive_daemon_module: reject invalid/over-long wire module names
  (> DAEMON_MAX_MODULE_NAME) with a clean STATUS_ERROR; client side already
  enforced via daemon_module_name_valid in config_parse_daemon_dest
- server.c daemonize: chdir(/) and umask(0) so module paths resolve from /
  and config-requested file modes are honored; PROTOCOL_VERSION stays 2.15.0
- test_daemon.py: confinement (read-only/unknown no-write anywhere), module-less
  and dot-dot destination refusal, real daemon_detach double-fork path

pytest.ini

@@ -5,3 +5,6 @@ markers =
     setpriv: privilege-dependent tests (drop to an unprivileged user); excluded
         from CI because their result depends on the runner/container uid and the
         host mount permissions, but run locally as root
+    daemon_detach: real double-fork backgrounding path (--daemon without
+        --no-detach); slower/fragile, so it runs in the full suite but not the
+        fast PR gate