fix(daemon): name the directory that actually refused, not the one after it

[DeusData]

fix(daemon): name the directory that actually refused, not the one after it

posix_directory_parent_secure(current_fd) validates the directory we are ALREADY
IN, but the refusal message printed component - the child about to be entered.
Every reporter has therefore been sent to inspect the wrong directory:

#1537 read "ancestor '.cache'" when /Users/ was refusing
#1621 read "ancestor 'cbm-daemon-501'" when /private/tmp was refusing

Both inspected the named directory, found it clean, and said so. They were
right. #1537 has been open for weeks with the reporter repeatedly confirming a
correct .cache - including on v0.10.4 today - because we kept pointing at it.

The message now names the CONTAINING directory and says explicitly not to check
the component itself.

This fixes no permission logic. It changes weeks of talking past each other into
a report someone can act on in a minute, which for this class of bug is the
whole game: the refusal is invisible from outside, so the message IS the
diagnosis.

Found while reviewing the CBM_RUNTIME_DIR work; the original detail was added in
the earlier half of #1537 and named the wrong variable from the start.