…ilure (issue #98)

The daemon registers an asyncExitHook (exit-hook) to kill kubo and destroy the
RPC server on shutdown. exit-hook only runs async hooks for SIGINT/SIGTERM/
beforeExit; an explicit process.exit() runs only synchronous hooks and prints
"SYNCHRONOUS TERMINATION NOTICE".

The notice's real trigger is the startup-failure path, not the force-quit guard
at daemon.ts:655 (by the second signal exit-hook's internal isCalled is already
true, so its synchronous handler returns before the warning). When the hook is
registered (daemon.ts:600), kubo is spawned by keepKuboUp() (:688), and then
createOrConnectRpc() (:689) throws — e.g. the #87/#97 TOCTOU RPC-port race — the
throw unwinds to oclif's error handler (@oclif/core errors/handle.js), which
calls process.exit(1). That skips the async cleanup: the notice prints, kubo is
orphaned, and this daemon's state file is left behind.

Fix:
- Extract the async exit-hook body into a named shutdownDaemon() and capture
  both the hook's unsubscribe handle and the fn (hoisted above the try).
- In the startup-failure catch, await shutdownDaemon() (kills kubo, destroys the
  RPC server, deletes the state file) and drop the hook before re-throwing, so
  oclif's process.exit() runs clean. No-ops if we failed before the hook was
  registered.
- In the force-quit guard, drop the hook before its deliberate process.exit() as
  belt-and-suspenders; kubo is still SIGKILLed by the emergency "exit" handler.

Test:
- Add a guarded test hook PKC_CLI_TEST_FAIL_AFTER_KUBO_START that throws at the
  top of createOrConnectRpc, after kubo is up, mirroring the real port race.
- New daemon.test.ts case "kills kubo (and prints no exit-hook termination
  notice) when startup fails after kubo is up": asserts non-zero exit, no
  SYNCHRONOUS TERMINATION NOTICE, and kubo stopped (not orphaned). Verified red
  before the fix, green after.

Full daemon.test.ts (23), update-install-restart-race, and
daemon-kubo-restart-race suites pass.

…ted path (issue #98)

Address CodeRabbit review on #99:

- Cap the manual startup-failure shutdown with DAEMON_SHUTDOWN_TIMEOUT_MS
  (Promise.race with an unref'd timer), matching the timeout contract the signal
  path gets from exit-hook's `wait`, so a hung daemonServer.destroy() can't
  swallow the original startup error forever. Low live risk (daemonServer is
  ~never set on the catch path and killKuboProcess is already bounded), but it
  keeps both exit paths consistent.

- Assert the test's combined output contains the injected failure message so the
  case stays pinned to the PKC_CLI_TEST_FAIL_AFTER_KUBO_START path instead of
  passing on any non-zero failure. Wrap the spawn in withKuboBindRetry so a lost
  kubo bind race (issue #87) retries with fresh ports rather than flaking the new
  message assertion.

daemon.test.ts (23), update-install-restart-race, and daemon-kubo-restart-race
all pass.