Fix config and CLI correctness/safety bugs in pilotctl

[TeoSlayer]

Fixes a batch of config-handling and CLI correctness/safety bugs in pilotctl, almost all in cmd/pilotctl/main.go.

Changes

1. Atomic + 0600 config writes — saveConfig serializes to a temp file in the config dir, chmod 0600, fsync, then rename over config.json. A crash mid-write can no longer leave a truncated or world-readable secrets file, and pre-existing loose permissions are not preserved.
2. loadConfig surfaces errors — a missing config stays silent (defaults apply); a permission/I-O error or a corrupt/half-written file is logged via slog.Warn instead of silently vanishing settings.
3. Honor PILOT_HOME — configDir checks PILOT_HOME before $HOME, so config/socket/PID state can be relocated.
4. set-hostname / clear-hostname report save failures — a failed saveConfig now aborts with an error instead of letting persisted config diverge from the running daemon.
5. Pipe-mode stdin scanner — buffer raised to 16 MiB and scanner.Err() is checked, so long lines and read errors no longer fail silently.
6. send-message --json --wait single document — the reply is folded into the one JSON envelope (data.reply) instead of printing a second concatenated JSON doc that breaks machine parsers. Human (non-JSON) output is unchanged.
7. bench size validation — rejects non-positive, NaN/Inf, and absurd sizes, caps at 4 GiB, and validates before dialing the daemon (fail-fast).
8. traceroute checks conn.Write — a write failure mid-trace is recorded and breaks the loop instead of blocking in Read for an echo that will never arrive.
9. parseFlags accepts dash-leading values — new isFlagValue lets --key -1, --key -3.14, --key - (stdin), and --key -3x pass through, while --name/-name tokens are still treated as the next flag.
10. daemon stop without a PID file — when the socket is live but the PID file is missing, the owning PID is discovered via lsof -t -U (same-UID only) and stopped, instead of punting to a manual kill.
11. Dial timeout/cancellation — ping, traceroute, connect, and bench now use DialAddrTimeout, so a timed-out command cancels the daemon-side dial rather than leaving a dangling connection or leaking a goroutine.

Tests

• zz_config_safety_test.go (new): config 0600 perms + no loose-perm preservation, atomic write leaves no temp file, PILOT_HOME precedence + round-trip, bench bad-size rejection, send-message --json --wait single-document assertion.
• zz_parsers_test.go: updated/added parseFlags cases for dash-leading values and "next flag is not a value".
• Test home helpers now clear PILOT_HOME for hermeticity.

Validation

• GOWORK=off go build ./..., go vet ./cmd/pilotctl/..., gofmt clean.
• GOWORK=off go test -count=1 -parallel 4 ./cmd/pilotctl/... green.
• No new dependencies; gating security CI (govulncheck, gitleaks) unaffected. cli-reference-check unaffected (no help-text changes).