feat(daemon): auto-handshake toward trusted agents on outbound dial

When DialConnectionContext targets a node in the trusted-agents list and
no local trust entry exists, a handshake request is fired in a background
goroutine. The SYN-retry loop succeeds once the peer approves, removing
the need to run pilotctl handshake before ping or send-message.

Author: teovl

CHANGELOG.md

@@ -33,6 +33,15 @@ Detailed per-release notes for tagged versions are published on the
   binaries triggered Gatekeeper "killed: 9" / "cannot be opened
   because Apple cannot check it for malicious software" on first run.
 
+## [1.9.2] - 2026-05-06
+
+### Added
+- **Auto-handshake toward trusted agents.** Dialing a known trusted agent
+  (pilotprotocol.network service fleet) now automatically initiates a
+  handshake in the background if no local trust entry exists. The SYN-retry
+  loop succeeds once the peer approves — no manual `pilotctl handshake`
+  required before `pilotctl ping` or `pilotctl send-message`.
+
 ## [1.9.1] - 2026-05-05
 
 Stable release rolling up rc1–rc5. Headline themes: cold-start latency

pkg/daemon/daemon.go

@@ -2439,6 +2439,16 @@ func (d *Daemon) dialConnectionLocked(ctx context.Context, dstAddr protocol.Addr
 		return nil, err
 	}
 
+	// Auto-initiate handshake toward known trusted agents when we have no
+	// local trust entry yet. Scoped to the trusted-agents list so we don't
+	// spray handshakes at arbitrary peers. Fires non-blocking so the
+	// SYN-retry loop succeeds once the peer approves.
+	if !d.handshakes.IsTrusted(dstAddr.Node) {
+		if _, ok := trustedagents.IsTrusted(dstAddr.Node); ok {
+			go d.handshakes.SendRequest(dstAddr.Node, "")
+		}
+	}
+
 	localPort := d.ports.AllocEphemeralPort()
 	if localPort == 0 {
 		return nil, ErrEphemeralExhausted