#3455 refactor(daemon): extract boot handling from session-state dispatcher

Summary

Part of #3424 (CRAP burn-down, umbrella #3414). Layer 1 of 4 splitting the two over-complex handlers in src/daemon/handlers/session-state.ts (handleSessionStateCommands CRAP 34, handleAppStateCommand CRAP 30).

This layer extracts the boot path only: handleBootCommand moves to src/daemon/handlers/session-boot.ts together with its exclusive helpers (resolveBootTarget, shouldAttachSourceAppIdentity, resolveBootSourceAppIdentity, buildSessionWireShapeFields, resolveAndroidTestApkPath). session-state.ts keeps the other command branches, delegating daemon_session_boot to the new module. No behavior change.

• handleSessionStateCommands: 34 → below the 30 gate at this layer (4.0 at stack top once layers 3–4 land).
• Tests split one-to-one: session-boot-shutdown.test.ts → session-boot.test.ts, session-state-boot-warmup.test.ts → session-boot-warmup.test.ts; shutdown coverage stays in session-boot-shutdown.test.ts (renamed in layer 2).

Part of the stacked split of session-state.ts for #3424 (umbrella #3414). Stacked on main; layers 2–4 stack on this PR.

Validation

• pnpm check:affected --run on this head: all runnable checks passed (2026-10-12).
• pnpm check:layering: pass; session-boot.ts registered in daemon-layer-manifest.json (daemon-sessions).

_{Created by Apex.}