Follow the macOS install layout for config, ACL, and identity paths

The macOS packaging installs config under /usr/local/etc/fips, wired through
the launchd plist and build-pkg.sh, but the default-path constants and the
config search path were hardcoded to /etc/fips for all Unix. On macOS the
daemon and fipsctl therefore looked in a directory that does not exist: the
ACL and host-map loaders hit their NotFound no-op arm and returned empty
state, so a populated peers.deny reported effective_mode "default_open" with
enforcement inactive, and host-file aliases went unloaded, with no error.

The peers.allow, peers.deny and hosts defaults now follow the platform's
packaging, and fipsctl keygen writes its identity there too. The config
search path keeps probing /etc/fips first and adds /usr/local/etc/fips after
it, so an existing install keeps working across the upgrade and the packaged
file still wins over a stale leftover. Both the macOS search-path entry and
the keygen output directory read one SYSTEM_CONFIG_DIR constant, so they
cannot drift apart. At startup the daemon warns once about hosts, peers.allow
or peers.deny stranded at the old location; the config file is deliberately
excluded, since both directories stay on the search path and a config left
behind is still read.

The control-socket snapshot tests repoint the ACL reloader at non-existent
paths under the temp dir, so the snapshot no longer reflects whatever ACL
files happen to exist on the machine running the tests.

Platform-gated unit tests pin both layouts, so a future refactor cannot
silently drift either one. Linux and Windows behavior is unchanged.

Adding a second system config directory moves the directory the daemon
derives the identity key path from, since that comes from whichever config
file loaded last. A host carrying fips.yaml at both locations would have
resolved fips.key to the new directory, found none, and under persistent
generated a fresh identity, silently changing its npub, routing address and
mesh IPv6 with no migration path. The daemon now adopts a key stranded at the
legacy path and warns to move it rather than generating one. The fallback is
confined to keys resolved from the system config directory, so a run using
./fips.yaml or a user config is never redirected to a system key.

Co-authored-by: Johnathan Corgan <johnathan@corganlabs.com>

src/control/queries.rs

@@ -2435,11 +2435,26 @@ mod tests {
     /// runtime state (no peers, links, sessions, transports, or cache
     /// entries). This keeps every per-element list empty and every
     /// scalar deterministic modulo `VOLATILE_KEYS`.
+    ///
+    /// The peer ACL is isolated from the host filesystem: the reloader is
+    /// repointed at non-existent paths under the process temp dir, so the
+    /// snapshot is stable regardless of whether an operator has edited the
+    /// real `peers.allow` / `peers.deny` on the dev/CI machine. Without this,
+    /// `show_acl` would reflect the host's live ACL state (e.g. a populated
+    /// `peers.deny` flips `effective_mode` from `default_open` to
+    /// `denylist`), making the snapshot machine-dependent.
     fn build_test_node() -> Node {
         let identity =
             Identity::from_secret_bytes(&TEST_SEED).expect("test seed is a valid secret key");
         let config = Config::new();
-        Node::with_identity(identity, config).expect("default config is valid")
+        let mut node = Node::with_identity(identity, config).expect("default config is valid");
+        let nonce = std::process::id();
+        let tmp = std::env::temp_dir();
+        node.isolate_peer_acl_for_test(
+            tmp.join(format!("fips-snapshot-test-{nonce}.allow")),
+            tmp.join(format!("fips-snapshot-test-{nonce}.deny")),
+        );
+        node
     }
 
     /// Recursively walk a JSON value, replacing the value of any key