feat(cli): 1.28.0 — bridge deletion + daemon-policy flags

drop the orphaned bridge tier (~600 LoC). client/server/protocol
files deleted; tryBridge had returned null in production for seven
releases since the 1.24.0 mcp shim rewrite stopped opening the
sockets. each verb now has two paths: daemon (with 1.27.3's
auto-spawn) → cold ws.

add per-process daemon policy: --strict (error instead of cold
fallback) and --no-daemon (skip daemon entirely). enforcement at
withMesh so a single chokepoint covers every verb. env equivalents
CLAUDEMESH_STRICT_DAEMON / CLAUDEMESH_NO_DAEMON. flag wins.

net -394 loc; the daemon-up case ships ~600 loc lighter and the
fallback story is one tier simpler. first sprint A drop; per-session
ipc tokens and the wizard refactors follow in 1.29.0+.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/ui/warnings.ts

@@ -7,6 +7,7 @@
  */
 
 import type { EnsureDaemonResult } from "~/services/daemon/lifecycle.js";
+import { getDaemonPolicy } from "~/services/daemon/policy.js";
 import { dim } from "./styles.js";
 
 let alreadyWarned = false;
@@ -27,6 +28,11 @@ export function warnDaemonState(
   if (opts.quiet || opts.json) return false;
   if (res.state === "up") return false;
 
+  // Under --strict, the cold-path gate at `withMesh` will print its own
+  // refusal message — suppress the misleading "using cold path" hint
+  // here so the user sees a single, accurate error.
+  if (getDaemonPolicy().mode === "strict" && res.state !== "started") return false;
+
   alreadyWarned = true;
   const tag = (label: string) => `[claudemesh] ${label}`;
   const hint = (s: string) => dim(s);