daemon clients lose the typed auth refusal when a preamble write hits a closed socket #4145

Found while fixing #4135 (PR #4144).

The daemon answers a rejected auth preface with one AuthenticationRejected refusal frame. It then drains pipelined input until one line read sits idle for 100 ms (write_refusal_and_drain in crates/tracedecay/src/daemon/connection_serving.rs) and closes. Production clients write the preface, the handshake and the first request as separate writes, and propagate a write error with ? before they read anything. Examples are write_daemon_handshake_preamble and core_client::call_tool. A client that stalls more than 100 ms between those writes gets Broken pipe, even though the refusal frame is already queued in its receive buffer. The stall can come from load or from a descheduled thread.

The impact is a raw transport error where the client should report the typed, retryable "stale daemon authority record" refusal.

Reproduction: add a 300 ms pause after the preface write in authentication_refusal_test on master. It fails 3 of 3 with write handshake: Os { code: 32, kind: BrokenPipe }. The merge gate hit the same failure twice on 2026-10-16. PR #4144 fixes the test's raw client. The production clients still have the race.

Suggested fix: when a preamble or request write fails with a broken pipe or reset, the client reads the next line before it surfaces the write error, and returns the refusal if one is there. The call sites are core_client.rs (2), core_proxy.rs, core_hooks.rs and the invocation client in tracedecay-daemon-protocol/src/client.rs.