fix(daemon): reuse auto-generated gRPC TLS material across restarts

[cidrblock]

Context

--grpc-tls always regenerates server.crt / server.key / ca.crt under the runtime tls/ directory on every start (writeAutoTlsMaterial). Clients that cached ca.crt break after a daemon (or container) restart.

Flagged during review of PR #63: #63

Proposal

• If valid cert+key already exist under tls/, reuse them instead of regenerating
• Document lifetime clearly in CONTAINER.md (and note when regeneration happens)
• Optional: volume-mount guidance so container CA remains stable across restarts

References

• PR fix(daemon): require TLS or --insecure for non-loopback gRPC (C2) #63
• DR-029