fix: uninstall stands the daemon down via the disable flag

[tsilenzio]

Summary

• vigil uninstall stopped the daemon with a bare pkill, which orphaned the caffeinate child (no signal handler, so no cleanup) holding the display awake up to its 30-minute -t cap. It now writes the .disabled sentinel, which the daemon notices reactively through its runtime-dir watch and clean-exits, killing its caffeinate on the way out.
• Exit is confirmed by probing the daemon's single-instance flock rather than pgrep, so unrelated processes can't produce false positives, and pkill survives only as a fallback for a daemon too wedged to see the flag within three poll intervals.
• The runtime dir removal is rechecked at execution time so the flag written during stand-down can't outlive the uninstall and block a future install's daemon.
• Adds docs/ANALYSIS.md (the 2026-07-14 code-review findings) with the three addressed entries already removed and AN-004 updated for what shipped today.

Test plan

• cargo fmt --check, clippy -D warnings, cargo test (30 tests) green locally
• End-to-end in sandboxed env dirs: a daemon holding a live caffeinate stood down in under a second, the caffeinate died with it (no orphan), the runtime dir was removed, and an unrelated live daemon was untouched
• CI (macOS check/test/clippy/fmt, conventions)