feat(cli): 1.28.0 — bridge deletion + daemon-policy flags

drop the orphaned bridge tier (~600 LoC). client/server/protocol
files deleted; tryBridge had returned null in production for seven
releases since the 1.24.0 mcp shim rewrite stopped opening the
sockets. each verb now has two paths: daemon (with 1.27.3's
auto-spawn) → cold ws.

add per-process daemon policy: --strict (error instead of cold
fallback) and --no-daemon (skip daemon entirely). enforcement at
withMesh so a single chokepoint covers every verb. env equivalents
CLAUDEMESH_STRICT_DAEMON / CLAUDEMESH_NO_DAEMON. flag wins.

net -394 loc; the daemon-up case ships ~600 loc lighter and the
fallback story is one tier simpler. first sprint A drop; per-session
ipc tokens and the wizard refactors follow in 1.29.0+.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/services/daemon/policy.ts

@@ -0,0 +1,42 @@
+/**
+ * Per-process daemon policy — set once at CLI entry from --no-daemon /
+ * --strict / env var, then read by daemon-routing helpers.
+ *
+ * Modes:
+ *   "auto"       (default) probe → auto-spawn → retry → cold fallback
+ *   "strict"     probe → auto-spawn → retry → ERROR (no cold fallback)
+ *   "no-daemon"  skip daemon entirely → straight to cold path
+ *
+ * Env equivalents (for headless/CI use):
+ *   CLAUDEMESH_STRICT_DAEMON=1   → strict
+ *   CLAUDEMESH_NO_DAEMON=1       → no-daemon
+ *
+ * Flag wins over env when both are set.
+ */
+
+export type DaemonMode = "auto" | "strict" | "no-daemon";
+
+export interface DaemonPolicy { mode: DaemonMode; }
+
+let policy: DaemonPolicy = readEnvDefault();
+
+function readEnvDefault(): DaemonPolicy {
+  if (process.env.CLAUDEMESH_NO_DAEMON === "1") return { mode: "no-daemon" };
+  if (process.env.CLAUDEMESH_STRICT_DAEMON === "1") return { mode: "strict" };
+  return { mode: "auto" };
+}
+
+export function setDaemonPolicy(mode: DaemonMode): void {
+  policy = { mode };
+}
+
+export function getDaemonPolicy(): DaemonPolicy {
+  return policy;
+}
+
+/** Pick a mode from parsed flags. CLI flags win over env. */
+export function policyFromFlags(flags: Record<string, unknown>): DaemonMode {
+  if (flags["no-daemon"]) return "no-daemon";
+  if (flags.strict) return "strict";
+  return readEnvDefault().mode;
+}