fix(supervisor): enforce peer-UID check in SupervisorSocket::bind()

[SequeI]

Linked Issue

Closes #

Summary

SupervisorSocket::bind() accepted connections without verifying the peers UID, unlike SupervisorListener::accept() which already checked it via SO_PEERCRED/getpeereid. Extract the check into a shared check_peer_uid() helper and apply it in both accept paths so identity verification doesnt depend solely on filesystem permissions/umask timing.

Test Plan

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+20
Lines removed	-9
Total changed	29
Classification	Small (< 50 lines)

Affected crates

• crates/nono (core library) — careful review required. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

No blocking issues; 0 findings.

Findings: none flagged in scope.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}