Fix global daemon implementation and improve security

- bd-159: Global daemon now runs in routing mode without opening DB
- bd-158: Set socket permissions to 0600 for security
- bd-160: Reject --auto-commit/--auto-push with --global
- bd-157: Verified stale socket cleanup (already working)
- bd-56: Closed as won't-do (cycle prevention is better)
- bd-73: Multi-repo support complete

internal/rpc/server.go

@@ -54,6 +54,12 @@ func (s *Server) Start(ctx context.Context) error {
 		return fmt.Errorf("failed to listen on socket: %w", err)
 	}
 
+	// Set socket permissions to 0600 for security (owner only)
+	if err := os.Chmod(s.socketPath, 0600); err != nil {
+		s.listener.Close()
+		return fmt.Errorf("failed to set socket permissions: %w", err)
+	}
+
 	go s.handleSignals()
 
 	for {