fix(daemon): never restart, delete or swap under a node that hasn't exited

Every operation that stops the node (restart, rescan, repair, delete
chain data, reinstall, bootstrap, wallet switch/adopt/restore/rebuild,
wizard restart, encrypt, decrypt) now:

- refuses up front while the node is rebuilding witnesses or has not
  answered for 30s, with a "try again when it's done" warning, and sends
  no stop;
- goes ahead only once the node's PROCESS has exited, not its RPC port.
  A stop that doesn't finish within 120s cancels the operation (warning;
  a cancelled rescan/repair disarms its flags); nothing is started over
  the old node, chain data isn't deleted, wallet.dat isn't swapped.

Specifics:
- stopDaemonForWalletSwitch() no longer reports "stopped" when the app
  is quitting (adopt could swap wallet.dat under a live node).
- Decrypt waited a fixed 3s after "stop" before renaming wallet.dat; it
  now waits for the process to exit, and scrubs the key export if not.
- Bootstrap waits for the process before cleanChainData and stops the
  node through the stop routine instead of the shared RPC client.
- StopScope::Connected lets switch/reinstall/decrypt stop an adopted or
  external node through the same never-kill routine.
- A bounded stop that can't reach the node (a foreign node refusing our
  credentials) gives up after 5s instead of 120s.
- macOS: isDaemonProcessRunning() checks processes (libproc), not the
  RPC port.
- rpcBusyWhileAlive() also reads the busy gate: since the gate, the
  first timeout usually lands on another lane and the 30s clock never
  started (also weakened the quit prompt for a silent rebuild).
- Notifications render during the first-run wizard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/daemon/embedded_daemon.cpp

@@ -38,6 +38,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #ifdef __APPLE__
+#include <libproc.h>
 #include <sys/sysctl.h>
 #endif
 #endif
@@ -1664,8 +1665,20 @@ bool EmbeddedDaemon::isDaemonProcessRunning()
         if (isDaemonProcessIdentity(comm, exe)) return true;
     }
     return false;
+#elif defined(__APPLE__)
+    // Match executables named dragonxd. Not the RPC port: dragonxd frees it early in its shutdown, long
+    // before the process exits and lets go of wallet.dat and the datadir lock.
+    const int count = proc_listallpids(nullptr, 0);
+    if (count <= 0) return isPortInUse(std::atoi(DRAGONX_DEFAULT_RPC_PORT));   // can't list: best effort
+    std::vector<pid_t> pids(static_cast<size_t>(count) + 64);   // room for processes started meanwhile
+    const int n = proc_listallpids(pids.data(), static_cast<int>(pids.size() * sizeof(pid_t)));
+    char path[PROC_PIDPATHINFO_MAXSIZE];
+    for (int i = 0; i < n && i < static_cast<int>(pids.size()); ++i) {
+        if (pids[i] <= 0 || proc_pidpath(pids[i], path, sizeof(path)) <= 0) continue;
+        if (isDaemonProcessIdentity("", fs::path(path).filename().string())) return true;
+    }
+    return false;
 #else
-    // macOS has no /proc; fall back to the RPC-port probe (best-effort).
     return isPortInUse(std::atoi(DRAGONX_DEFAULT_RPC_PORT));
 #endif
 }