fix(security): eliminate TOCTOU vulnerability during socket removal (#36)

Directly attempt to remove the daemon socket file and handle NotFound errors
instead of checking for its existence first. This prevents a potential
race condition where the file could be replaced between the check and
the removal.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

src/bin/daemon.rs

@@ -47,8 +47,10 @@ async fn main() -> Result<(), Box<dyn Error>> {
     lock_file.lock()?;
 
     let socket_path = runtime_dir.join("daemon.sock");
-    if fs::metadata(&socket_path).is_ok() {
+    if let Err(e) = fs::remove_file(&socket_path) {
-        fs::remove_file(&socket_path)?;
+        if e.kind() != std::io::ErrorKind::NotFound {
+            return Err(e.into());
+        }
     }
 
     let listener = UnixListener::bind(&socket_path)?;