#3575 worker daemon enable has no --ca-cert or --concurrency (worker connect has both)

Summary

swamp worker daemon enable has no --ca-cert (or --concurrency), though swamp worker connect has both. The service also starts with only SWAMP_CONFIG_DIR set, so a worker installed with daemon enable can't trust a private CA. It fails TLS against a serve that uses a private-CA certificate (for example, a tailnet-only serve) until the unit or plist is edited by hand, and that edit is lost the next time daemon enable runs.

Where (origin/main ab2d51aa)

• swamp help worker connect options: --token --token-file --server-token --server-token-file --label --data-plane-url --cache-dir --no-reconnect --max-dispatches --idle-timeout --concurrency --ca-cert
• swamp help worker daemon enable options: --user --token --token-file --server-token --server-token-file --label --cache-dir --data-plane-url --max-dispatches --idle-timeout --no-reconnect (no --concurrency, no --ca-cert)
• src/cli/commands/worker_daemon.ts:
  • workerDaemonBaseEnv() returns only SWAMP_CONFIG_DIR.
  • collectWorkerEnv() maps only the options above, so neither SWAMP_CA_CERT nor SWAMP_WORKER_CONCURRENCY can reach the service, even when they're set in the shell that runs daemon enable.

Reproduce

1. swamp serve --host <tailnet-ip> --cert-file server.pem --key-file server.key --auth-mode token, with the certificate signed by a private CA.
2. swamp worker daemon enable wss://<host>:<port> --user --token-file … --server-token-file … --cache-dir …
3. The worker service fails the TLS handshake (unknown issuer).
4. Workaround: add SWAMP_CA_CERT=<ca.pem> to the plist's EnvironmentVariables or the unit's Environment= by hand. Re-running daemon enable overwrites it.

Proposed fix

1. Add --ca-cert <path> to worker daemon enable. Resolve it to an absolute path and check that it exists, as --cache-dir is checked since #1414, so a relative path doesn't break under launchd or systemd. Write it to the service as SWAMP_CA_CERT.
2. Add --concurrency, written as SWAMP_WORKER_CONCURRENCY.
3. Prevention: a test that every worker connect option either has a worker daemon enable counterpart or is on an explicit exclusion list, so the two commands can't drift apart again.

Environment

swamp 20261016.021405.0-sha.b46b8895; worker daemons on Linux (systemd --user) and macOS (launchd agent).