#3599 Docs: worker daemon enable reference is missing --ca-cert, --concurrency and SWAMP_SERVE_EXTRA_HEADERS

swamp-club#3575 brings worker daemon enable to parity with worker connect. The manual page content/manual/reference/remote-execution/worker-commands.md (section: swamp worker daemon enable) needs:

• Flags table: add --ca-cert (PEM CA certificate to trust for the orchestrator; made absolute and must exist; a system service must be able to read it; written as SWAMP_CA_CERT) and --concurrency <n|auto> (dispatch slots; auto resolves to the CPU count of the machine running the service; written as SWAMP_WORKER_CONCURRENCY).
• Note that relative --token-file, --server-token-file, --cache-dir and --ca-cert paths are made absolute at enable time.
• Note that SWAMP_SERVE_EXTRA_HEADERS set in the shell running daemon enable is carried into the service (header names are printed, values are not).
• Note that enable now refuses values worker connect would refuse at start (non ws/wss URL, --max-dispatches below 1, invalid --idle-timeout, --concurrency, labels containing a comma that does not start another key=value, invalid headers).
• The usage line should list the new flags.
• Labels: when a --label value contains a comma (or spaces the service trims), daemon enable still installs but warns that the service reads it as different labels, e.g. --label a=x,y=z reaches the service as a=x and y=z (labels go to the service comma-separated). A label the service cannot read back at all (e.g. a=b,c) is refused, naming the offending --label.
• The daemon enable description says SWAMP_SERVE_EXTRA_HEADERS from the enabling shell is written into the service.

Implemented in swamp-club/swamp#3191.