fix(daemon): reword the overflow-uid note so the security audit stops blocking it

scripts/security-audit.sh greps src/ for the fork call literal and blocks any
file that is not on the allow-list. The note explaining why the overflow uid is
no longer cached quoted that literal while describing the hazard, so the audit
refused src/daemon/ipc.c -- on a COMMENT, in a file that performs no such call.

Reworded rather than allow-listed. An allow-list entry would have silenced the
check for the whole file, permanently, so that one sentence could keep its
punctuation; the scanner is right to be blunt here and the comment is the
cheaper thing to change. The reason is recorded inline so the next person does
not reintroduce it.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

src/daemon/ipc.c

@@ -1596,9 +1596,12 @@ static uid_t posix_compute_ancestor_overflow_uid(void) {
  * DERIVED FRESH ON EVERY CALL, deliberately. This used to memoise via
  * pthread_once behind a comment claiming "immutable /proc state". That claim
  * was false in both halves: unshare(CLONE_NEWUSER) rewrites
- * /proc/self/uid_map, and pthread_once state survives fork() already marked
- * done -- so a process that forked and then changed namespace kept the parent
- * answer and refused a directory it should have accepted. It happened to be
+ * /proc/self/uid_map, and pthread_once state survives a forked child already
+ * marked done -- so a process that forked and then changed namespace kept the
+ * parent answer and refused a directory it should have accepted.
+ * (Spelled without the call syntax on purpose: scripts/security-audit.sh
+ * blocks that literal in src/, and an allow-list entry to let a COMMENT pass
+ * would weaken a real check on a real file.) It happened to be
  * harmless because every caller today runs in a freshly exec'd process, but
  * that made a security decision depend on an invariant nothing enforced, and
  * the next fork-without-exec caller would have silently inherited a stale