v1.7.2 — coverage tier push: 67.3% to 72.2% line coverage

- Dashboard SSE streams refactored into testable payload builders
  (stats_patch_line, radar_list_payload, initial_event_from)
- CaStore::default_dir contract under test
- InstanceGuard drop removes the unix socket file
- Earlier in the cycle: dashboard HTTP handlers, rules CRUD with real
  state and persistence, stats counters/broadcasts, listener
  bind/rebind lifecycle, TeeWriter log mirroring

Tier status: pure logic at 90-100%, HTTP/async layer at 80%+,
OS glue (gsettings/registry/launchd/browser) intentionally untested
from Linux.