fix: close daemon socket after programmatic load() to prevent process hang

[Copilot]

After await load() resolves keychain(...) values, the process hangs because the daemon client's Unix socket (~/.varlock/local-encrypt/daemon.sock) remains open and ref'd, keeping the event loop alive indefinitely.

Changes

• daemon-client.ts — Call socket.unref() on connect. The idle socket no longer holds the event loop open. In-flight sendMessage calls are unaffected: their setTimeout timers keep the event loop alive while waiting for responses (including biometric/interactive ops with their 5-min timeout).

• local-encrypt/index.ts — Add cleanupDaemonClient() helper that calls cleanup() on the singleton if one was created. Belt-and-suspenders for runtimes where unref() alone may not suffice.

• index.ts — Call cleanupDaemonClient() at the end of load(), and export a public cleanup() for users who need explicit lifecycle control:

import { load, cleanup } from 'varlock';

await load(); // daemon socket is now closed automatically

// or explicitly, e.g. after direct keychain usage outside load():
cleanup();

[philmillman]

@theoephraim might be unnecessary (see linked issue) feel free to close

[theoephraim]

seems reasonable, but currently we dont even talk about using load() anywhere, or provide any other guidance. Im wondering if we should get rid of it, or at least mark it as internal or something 🤷

[philmillman]

seems reasonable, but currently we dont even talk about using load() anywhere, or provide any other guidance. Im wondering if we should get rid of it, or at least mark it as internal or something 🤷

yeah I'll defer to you there. I think we can close