fix(tmux): isolate e2e tests on a throwaway socket, never the live yeschef server

[jakemassoth]

Root cause

The tmux -L socket name was a hard const TMUX_SOCKET = "yeschef" in the real backend (src/backend/real.rs), and tests/e2e.rs mirrored it with its own "yeschef" const. So the e2e suite — via both the assert_cmd-spawned yeschef binary and its direct tmux helpers (tmux(), WindowCleanup) — created and killed sessions on the same private server that the head chef and every live line cook run on.

Running cargo test --test e2e -- --ignored from inside a live yeschef session therefore tore down the very tmux server the shell was living in — killing the running line cook and the head chef. A stray kill-server on that socket would nuke the whole brigade. A live footgun of the same shape existed in docs/tmux-backend-demo-setup.sh, whose reset step ran tmux -L yeschef kill-server.

This was a structural isolation defect: tests (and dev/demo runs) could touch the operator's live tmux server.

The fix

Make the socket configurable and route every tmux invocation through one source of truth:

• backend::real — replace the const with DEFAULT_TMUX_SOCKET ("yeschef") + resolve_tmux_socket(), which reads YESCHEF_TMUX_SOCKET and falls back to the default when unset/empty. The socket is resolved once per backend in new and used in cmd(). Production behavior is unchanged — unset env → yeschef.
• tests/e2e.rs — pick a unique, throwaway -L socket per run (yeschef-test-<pid>-<nanos>, computed once via OnceLock), export it as YESCHEF_TMUX_SOCKET for every spawned binary (TestEnv::cmd), and point the tests' own tmux/cleanup helpers at the same name. The suite now stands up and tears down its own private server; no test path can reach the yeschef socket.
• docs/tmux-backend-demo-setup.sh — pin the demo (and its reset kill-server) to a yeschef-demo throwaway socket via YESCHEF_TMUX_SOCKET, so it can never nuke the operator's live server.
• Docs — DEVELOPMENT.md, flake.nix comments, and the module/e2e headers updated to describe the configurable socket.

Verification

Ran the full --ignored e2e suite from inside a live yeschef line-cook session (TMUX=.../yeschef,...), the exact scenario that used to self-destruct:

• Before: live yeschef server had headchef + yeschef-yeschef-fix-test-socket (this session).
• cargo test --test e2e -- --ignored --test-threads=1 → 17 passed.
• After: the live yeschef server was untouched — both sessions still alive, this session survived. The tests ran on yeschef-test-0000cb3e-…, which afterward reported no server running (stood up and tore itself down).

Also clean: cargo build, cargo fmt --check, cargo clippy --all-targets -- -D warnings -D clippy::pedantic, cargo test --bin yeschef (67 passed), and the flake nixfmt check.