feat(comms): move comms + listeners to daemon ownership (#482)

[ALRubinger]

Summary

Final ADR-0012 cleanup. Replaces the per-launch CommsServer (~530 lines of unix-socket IPC) with four HTTP long-poll endpoints on the daemon, and moves Slack/Discord listener startup to a vault-unlock callback. Closes the comms half of #454.

• Drops notifications: from the per-project policy schema; the types now live in internal/config (added in feat(config): add user-level AileronConfig with notifications schema #481).
• Moves NotifyQueue + listener startup helpers from internal/launch to internal/comms. The daemon owns one queue + one listener registry, shared across all launches.
• Adds four OpenAPI endpoints under `/v1/sessions/{id}/comms/` — `messages` (GET) + `send` / `draft` / `http` (POST, long-poll). Send-shaped endpoints register on the existing `ActionApprovalQueue` and mirror the 9A shell-approval wire shape from feat(comms): route aileron-sh shell approvals through the daemon #479.
• Wires `app.Config.OnVaultUnlock`; `UnlockLocalVault` fires it after swapping in the unlocked vault. The daemon registers a callback that resolves Slack/Discord tokens and starts listeners — relock teardown is deferred per the issue scope.
• Switches `aileron-mcp` from the unix-socket dial to HTTP. `AILERON_COMMS_SOCKET` is gone; `AILERON_COMMS_URL` + `AILERON_SESSION_ID` replace it.
• Strips launch-side comms: deletes `commsserver.go`, the bridge / startup helpers in `launcher.go`, and the per-session `/tmp/ai-comms-{sessionID}.sock` binding.
• Repoints `aileron status notifications` and the Slack/Discord guides at `~/.aileron/config.yaml`.

Test plan

• `go test ./... -race` green across cmd + internal modules.
• `go vet ./...` clean.
• Coverage on the new `handlers_comms.go` is 81.6%; `internal/comms` package is 87% — both above the 80% bar.
• Daemon-side handler tests cover happy path, validation errors, 503 when comms not configured, timeout, and dispatch failure for each of the four endpoints.
• Vault-unlock callback test confirms the callback fires with the freshly-unlocked vault, that a panicking callback doesn't poison the unlock, and that nil-callback is a no-op.
• `aileron-mcp` HTTP tests mirror the `promptapproval_test.go` pattern from feat(comms): route aileron-sh shell approvals through the daemon #479.
• `internal/launch/commsserver.go` no longer exists.
• `aileron-mcp` no longer references `AILERON_COMMS_SOCKET`.
• End-to-end manual: configure `~/.aileron/config.yaml` with a Slack `notifications:` block, unlock the vault via the webapp, run `aileron launch claude`, post a message in Slack, observe via `read_messages` MCP tool.

🤖 Generated with Claude Code

[railway-app]

🚅 Deployed to the aileron-pr-484 environment in aileron

Service	Status	Web	Updated (UTC)
docs	✅ Success (View Logs)	Web	May 6, 2026 at 10:11 pm

[codecov]

Codecov Report

❌ Patch coverage is 77.23292% with 130 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.18%. Comparing base (9ce1927) to head (a237892).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #484      +/-   ##
==========================================
- Coverage   82.36%   82.18%   -0.18%     
==========================================
  Files         236      237       +1     
  Lines       24127    24134       +7     
==========================================
- Hits        19872    19835      -37     
- Misses       3117     3137      +20     
- Partials     1138     1162      +24     

Flag	Coverage Δ
integration	8.59% <4.31%> (+0.17%)	⬆️
unit	78.84% <77.23%> (-0.18%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.