fix(cli): fail fast when the broker credential fd is not inherited

[ysyneu]

Problem

In broker mode fduty talks to Flashduty through a control socket that the runner passes as an inherited fd (FLASHDUTY_CRED_FD). Callers that spawn fduty without passing inherited fds close or reuse that fd:

• Python subprocess (close_fds=True by default)
• Node child_process
• sudo

Until now this failed only at the first request, and the cause came last, after the SDK's request URL:

Error: flashduty: request to http://flashduty.broker.local/...?app_key=... failed: Post "http://flashduty.broker.local/...": broker handshake send: bad file descriptor

Nothing in the message says how to fix it.

Change

newBrokerHTTPClient now checks getsockopt(SOL_SOCKET, SO_TYPE) on the fd before it builds the client. If the fd is not an open socket, it returns this error:

Error: FLASHDUTY_CRED_FD=3 is not an open socket in this process (bad file descriptor): the program that started fduty did not pass the credential channel down. Run fduty from the shell, or keep fd 3 open when spawning it: Python subprocess.run(cmd, pass_fds=(3,)); Node: set entry 3 of spawn's stdio array to 3

The function now returns (*http.Client, error). As a result:

• the non-unix stub returns errBrokerUnsupported directly, and that sentinel is defined only in broker_dial_other.go;
• root.go no longer needs its nil check.

Verification

• make passes: golangci-lint reports 0 issues, go test -race ./... passes, and the build succeeds.
• GOOS=linux go vet and GOOS=windows go build both pass.
• internal/cli tests pass on Linux (SOCK_SEQPACKET) in a python:3.12-slim container.
• A new test, TestDefaultNewClient_CredFDNotInherited, covers a closed fd and a regular-file fd.
• In the same container, a Python subprocess.run(["fduty", ...]) call with default arguments now prints the error above as its first stderr line. With pass_fds=(N,), the handshake reaches the control socket.