Env, args and protocol changes are invisible once rescan applies them (#108 residual)

[iceteaSA]

Problem. After ck module rescan applies a change that touches only env, args or protocol, every surface says the running module is current while the process still runs the old spec. ck module list shows reload nothing, pending_reload shows path and image match, and a second rescan --dry-run reports no changes. The #108 fix covers the program path and a swapped binary, as ruled there; these fields were out of scope.

Evidence (master 5d1501d).

• PendingReloadVerdict carries only path and image (crates/subc-control/src/lib.rs:615-617).
• The rescan compares config against the stored spec (crates/subc-daemon/src/control.rs:4064-4069), and apply overwrites the stored spec through update_configuration (:4154-4158). After apply, nothing is left to differ.
• docs/daemon-config.md:141-143 names protocol (and args) changes as pending-reload differences.
• Repro on our install (2026-09-24): I removed one env var from a module's entry, and rescan printed changed-pending-reload. Afterwards the list said nothing and the dry-run said "no changes", while the running process's environment still had the removed variable.

Question. Which of these?

• (a) Render what is actually compared (e.g. nothing (path, image)) and document that env/args/protocol edits stay invisible until the next restart.
• (b) At spawn, record a digest of the effective launch spec (program, args, env, protocol) beside spawned_from. Compare it with the configured spec's digest and add a spec: match | mismatch | unavailable dimension. It is derived rather than stored, like ck module rescan --dry-run says "would restart", apply defers — and once applied, a second dry-run reports "no changes" while the old process is still running #108's other two signals, and keeps env values off the wire.

I recommend (b) and can build it if you want it.

[subc-alfonso]

Confirmed: after an env-, args- or protocol-only rescan is applied, the stored spec is overwritten and pending_reload compares only path and image, so nothing is left to differ. That contradicts docs/daemon-config.md.

(b) is the right shape, and yes, please build it. Conditions:

1. The digest covers the configured launch inputs only: program, args, the module's configured env block, and protocol. It excludes the daemon's inherited environment and the per-spawn values the daemon injects (launch nonce, module id, connection file path), which change on every spawn and would make every module read as mismatched.
2. The digest stays inside the daemon. Only the verdict (match | mismatch | unavailable) goes on the wire. A plain hash of env values on the wire would let someone test guesses for low-entropy values offline.
3. unavailable when there is no running process, or the running process was spawned by a daemon that did not record a digest. It must never read as match.
4. The new field on PendingReloadVerdict is #[serde(default)], and ck renders it as "not reported" when an older daemon omits it. This needs a minor bump of subc-control.
5. Tests: one for each of env, args and protocol showing mismatch after apply and match after the restart, plus a control that changes the connection file path or nonce between spawns and still reads match.

I'll add the design-approved label so the PR passes the design gate.