fix!: fix socket/path coordination amongst minimal/minvmd/minimald - #690

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci-macos.yml:
- Around line 238-241: The macOS CI job creates a new temporary XDG_STATE_HOME
with mktemp -d in the local provider setup, but the current EXIT trap only stops
the daemon and never removes that directory, so temp state accumulates on the
persistent self-hosted runner. Update the cleanup logic in the same workflow
block that sets XDG_STATE_HOME so the temp directory is removed on exit,
alongside the existing daemon shutdown. Apply the same fix in both local
provider setup sections referenced by the comment, using the existing
trap/cleanup flow around the provider startup steps.

In `@crates/minimald/src/main.rs`:
- Around line 101-103: Guard the Unix domain socket path used by listen_on()
before binding, because
client_instance_dir().sub_path_unchecked(paths::SSH_SOCK_FILE) can produce a
path longer than sockaddr_un.sun_path and cause UnixListener::bind to fail on
long state/temp directories. Add a length check in the listen_on()/socket-path
construction flow and either reject overly long paths with a clear error or
shorten the generated SSH socket path while keeping the existing
client_instance_dir and SSH_SOCK_FILE lookup logic intact.

---

Nitpick comments:
In `@crates/paths/src/lib.rs`:
- Around line 1458-1469: The test minimal_state_dir_honors_xdg_state_home
mutates process-global environment state with set_var/remove_var, which can race
with parallel tests. Update this test to serialize env-mutating access using a
shared guard/Mutex or switch to a scoped helper such as temp-env so
XDG_STATE_HOME is only overridden within the test’s closure; keep the fix
localized around minimal_state_dir and the env save/restore logic.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/minvmd/tests/boot_e2e.rs`:
- Around line 24-31: The short_state_dir() helper is duplicated across multiple
test binaries, so consolidate it into a shared test module instead of keeping
the same logic and rationale comment in boot_e2e.rs, minimald_session_e2e.rs,
and bridge_e2e.rs. Move the helper into a common location such as
tests/common/mod.rs or a small #[path]-included module, then update the affected
test files to import and use that shared short_state_dir() so the tempdir prefix
and sun_path overflow workaround stay consistent in one place.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/minimald/src/main.rs`:
- Around line 266-289: The readiness check in the detached startup loop is too
weak because `UnixStream::connect` plus `MINIMALD_LOCK_FILE` can succeed before
the child has finished conflict checks and bound its own socket. Update the
`main` startup polling logic to use a child-specific readiness signal tied to
the child process itself—such as having the child write its PID only after
binding and verifying `MINVMD_LOCK_FILE`, and having the parent verify that
signal before returning success. Keep the existing `child.try_wait()` failure
path, but make the success path depend on this post-bind readiness signal
instead of the shared `ssh.sock`/instance-lock combination.