Deterministic local Executor Protocol v1 socket discovery.
The same algorithm is implemented by the reference SDKs: an explicit path
wins, followed by TAY_SOCKET_PATH, then a usable XDG runtime directory, a
usable TMPDIR, and finally a per-UID /tmp directory. Automatic paths own
their final directory and request mode 0700; explicit/environment paths
never cause Tay to chmod a caller-owned parent directory.