refactor(daemon): move singletons into per-daemon layers

[FreshlyBrewedCode]

Part of #32 · Closes #38

Four maps lived at module scope — server/runs.ts's active-run registry, server/pubsub.ts's subscribers, lib/dedupe.ts's exported dedupeRegistry, and lib/workspace.ts's refreshGates — which meant two daemons could not coexist in one process and every feature since #13 paid rent on it as another optional test-seam field (dedupeRegistry?, registry?, now?, beforeStart?). #36 gave the daemon a composition root to put them behind; this PR moves them there and retires the seams, without touching the one thing that must not move: the synchronous check-then-set that reserves a registry slot and claims a dedupe key (D24/D29, #15).

What changed

• createRunRegistry(), createPubSub(), createDedupeRegistry() (already existed) and the new createRefreshGates() replace the four module-level singletons; each is a plain closure over a Map, not an Effect service.
• DaemonServices (registry, pubsub, dedupeRegistry, refreshGates) is built once per startDaemon() call and threaded explicitly through startTrackedRun, dispatchChildRun, makeScheduleFire, and every HTTP handler in server/http.ts — no daemon reads another daemon's state.
• dedupeRegistry?, registry?, now?, and beforeStart? are gone; tests build a DaemonServices bag (createTestServices()-style helpers) instead of injecting optional fields.
• The scheduler's clock is now a Clock.Clock value (SchedulerDeps.clock), sourced from a createLiveClock() in daemon.ts for production and Effect's real TestClock (effect/testing) in scheduler.test.ts, rather than a bespoke now?: () => number.
• src/server/two-daemons.test.ts is new: starts two full daemons (startDaemon) in one process, asserts independent run lists, cross-daemon 404s, independent registry.activeRunIds(), and that the same dedupe key succeeds on both daemons at once — proving the dedupe registries don't share state either.
• Along the way: ConcurrencyLimitError/DispatchCapError picked up a mid-stack regression back to plain Error subclasses and were restored to Schema.TaggedError (matching Represent domain failures as Schema.TaggedError #34/base already), and DedupeKeyError gained a message getter plus a DispatchCollision.error field so the collision reason is readable from the event log, not just the typed fields.
• Review follow-ups: dropped a 0-byte sandbox artifact (data/src/factory/.factory/workspaces/.../.tanstack-projected-...) that had leaked into an earlier commit, and switched scheduler.test.ts from a hand-rolled fake Clock.Clock to Effect's real TestClock.

Notes for reviewers

• Atomicity of slot reservation + dedupe claim: in startTrackedRun (src/server/runs.ts), registry.get(runId), dedupeRegistry.claim(...), admitRun(...), and registry.reserve(runId) are all plain synchronous calls on plain Map-backed objects, with the first await (allocateWorkspace) only reached afterward, inside the try. No microtask boundary was introduced between check and set — this held for the pre-refactor module-level version and still holds now that the same Maps live behind services.registry/services.dedupeRegistry instead of at module scope, and still holds at this PR's current head (src/server/runs.ts was untouched by the review follow-ups). Verified by reading the resulting code path, not just the diff hunks.
• TestClock: scheduler.test.ts now uses effect/testing's real TestClock instead of a hand-rolled fake. tickOnce/createSchedulerState stay deliberately plain async (ADR 0009 §5) and only ever read the clock synchronously via currentTimeMillisUnsafe() — they never suspend on Effect.sleep, so none of TestClock's fiber-coordination machinery (scheduled sleeps, the hung-test warning fiber) actually gets exercised. But building the clock once per fixture via Effect.runPromise(Effect.scoped(TestClock.make())) and bridging setTime back into the plain-async fixture (the same pattern ManagedRuntime uses for bridging Effect services into imperative code) composes cleanly with no contortion of tickOnce or production code, so there was no reason to keep the fake.
• The stray committed artifact noted in an earlier revision of this PR (data/src/factory/.factory/workspaces/run-69780571-.../.tanstack-projected-1e95f9272dfe038f, leaked in 2f97451, same failure mode refactor(runtime): move headless permission setup into the agent adapter #55 hit) has been removed via git rm; .gitignore already covered data/ and .tanstack-projected-*, and no other stray data/ or .factory/workspaces/ paths are tracked on this branch.
• fix: add port guard in two-daemon test for typecheck is a real narrowing check (port1/port2 can be undefined per Bun.serve's type), not a weakened assertion.

Verification

• New test: src/server/two-daemons.test.ts (two-daemon isolation, the acceptance criterion's own proof).
• Existing concurrency (concurrency.test.ts), dedupe (dedupe.test.ts, server/dedupe.test.ts), and nested-run (nested-runs.test.ts) tests were updated to thread DaemonServices through but keep the same assertions/intent, including the M1 "reserved before any await" race test in runs.test.ts, which now holds the window open via real allocateWorkspace timing instead of the removed beforeStart? hook.
• bun run check (format:check + lint + typecheck + bun test) run locally at this PR's head: 311 pass, 0 fail, typecheck clean, lint clean (pre-existing effecttsgo style warnings only, no errors).

Stack

1. refactor(cli): replace hand-rolled parsers with effect/unstable/cli #52 — Parse CLI with Effect CLI (issue Parse CLI arguments with effect/unstable/cli #33)
2. refactor(errors): represent domain failures as Schema.TaggedError #53 — Domain errors as tagged errors (issue Represent domain failures as Schema.TaggedError #34)
3. refactor(runtime): move chunk interpretation into the agent adapter #54 — Move chunk interpretation into adapter (issue Move chunk interpretation into the agent adapter #35)
4. refactor(runtime): move headless permission setup into the agent adapter #55 — Move headless permission setup into the agent adapter (issue Move headless permission setup out of the workspace allocator #37)
5. feat(runtime): add Effect composition root and agent runtime service #56 — Agent runtime service (issue Add an Effect composition root and make the agent runtime a service #36)
6. refactor(daemon): move singletons into per-daemon layers #57 — Move singletons into per-daemon layers (issue Move the daemon's remaining singletons into layers #38) ← this PR

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}