native2: client doesn't verify the host, but docs/embed.md says it does #191

In native2 only the host checks its peer: DesktopHost/Server.swift:148 admits a client when Peer.satisfies matches the team and exact identifier. Neither the client CLI, desktop-tools-mcp nor DesktopAppLink checks the host's signature before sending requests; they exchange only a version hello.

The Peekaboo-based client did check (native/sources/client/client.swift, trustedHostTeamIDs), and docs/embed.md:24 still says "the client verifies the host's team".

The risk is that a process at the socket path that isn't our host gets the agent's requests, and can lie about results.

Either:

• add the reverse check: Peer(socket:) on the client side, requiring the host to be signed by the same team (as ownSigning() already does for the host), or
• if dropping it was deliberate, update docs/embed.md to say so and why.

Found while updating the Desktop Tools write-up for native2 (checked at 0d89ab5).