Detect config drift for detached proxy daemons or add an explicit reload path

[GuthL]

Summary

Detached keyclaw proxy daemons read their effective config at process start, but the operator workflow still makes it easy to change ~/.keyclaw/config.toml or environment overrides, re-source ~/.keyclaw/env.sh, and assume the running daemon picked those changes up.

Evidence

• README.md:496-497 and docs/configuration.md:161-162 already warn that daemon-side settings are latched at startup.
• src/launcher/bootstrap/proxy_daemon.rs tracks pid/env state, but there is no config fingerprint, drift warning, or reload command.

Why this matters

This is a recurring operator footgun: the shell can be pointed at the right proxy while the daemon still uses stale interception hosts, timeout knobs, audit settings, or logging behavior.

Suggested scope

• Add either keyclaw proxy reload or a config fingerprint/drift check in keyclaw proxy status / keyclaw doctor.
• Make the running daemon's effective config easier to inspect.
• Document the supported restart/reload path once the UX is in place.