#3604 worker daemon enable: an unreadable --ca-cert passes enable, and SWAMP_SERVE_EXTRA_HEADERS is silently dropped under sudo

Follow-ups from the post-merge adversarial review of swamp-club/swamp#3191 (swamp-club#3575).

1. An unreadable --ca-cert passes enable, then the service restarts forever

validateCaCertFile in src/cli/commands/worker_daemon.ts only stats the path: it checks that the file exists and is a regular file, but never reads it. A CA file that exists but can't be read passes enable. Examples: mode 000, or a file owned by another user in --user mode. The service then fails on every start with 'Could not read CA certificate file' (getEnvCaCerts) and restarts forever, the exact failure #3191 says enable now prevents. The token files already get a real read through readTokenFile.

Fix: read the file at enable time and turn a read error into a UserError that names the resolved path. Optionally, also refuse a file that doesn't look like PEM.

2. SWAMP_SERVE_EXTRA_HEADERS is silently dropped under sudo

daemon enable now copies SWAMP_SERVE_EXTRA_HEADERS from the enabling shell into the service. A system-mode service is normally enabled with sudo, and sudo's default env_reset strips the variable. A user who exported the headers gets a service without them, with no warning. The worker is then refused at the reverse proxy (401/403) and keeps reconnecting.

Fix (recommended): document that system mode needs sudo -E or sudo --preserve-env=SWAMP_SERVE_EXTRA_HEADERS, both in the daemon enable help and in the manual (see swamp-club#3599). Optionally also print a hint when enable runs under sudo (SUDO_USER set) and the variable is unset. Weigh that against the noise it adds for sudo users who don't use headers.

Repro

1. chmod 000 ca.pem, then: swamp worker daemon enable wss://host:port --user --token-file ... --ca-cert ca.pem. Enable succeeds, and the service then fails on every start.
2. export SWAMP_SERVE_EXTRA_HEADERS='Tunnel-Token: x', then: sudo swamp worker daemon enable wss://host:port --token-file ... The service definition has no SWAMP_SERVE_EXTRA_HEADERS, and enable prints no extra-headers line.