[client] Improve error surfacing for restricted daemon sockets (#7704)

* Add probe for daemon restriction and improve error surfacing

client/internal/daemonaddr/probe.go

@@ -0,0 +1,52 @@
+package daemonaddr
+
+import (
+	"context"
+	"errors"
+	"io/fs"
+	"net"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// accessProbeTimeout bounds the probe.
+const accessProbeTimeout = time.Second
+
+// DeniesCaller reports whether the OS refuses this process access to the daemon
+// socket or pipe at addr. It dials without gRPC, trying up to two candidate
+// pipe paths on Windows; loopback TCP is never probed.
+func DeniesCaller(ctx context.Context, addr string) bool {
+	ctx, cancel := context.WithTimeout(ctx, accessProbeTimeout)
+	defer cancel()
+
+	conn, err := dialRaw(ctx, addr)
+	if err != nil {
+		return errors.Is(err, fs.ErrPermission)
+	}
+	if err := conn.Close(); err != nil {
+		log.Debugf("close daemon access probe: %v", err)
+	}
+	return false
+}
+
+func dialRaw(ctx context.Context, addr string) (net.Conn, error) {
+	if name, ok := strings.CutPrefix(addr, pipeScheme); ok {
+		return dialPipePaths(ctx, PipePaths(name))
+	}
+	if path, ok := unixSocketPath(addr); ok {
+		var d net.Dialer
+		return d.DialContext(ctx, "unix", path)
+	}
+	// Loopback TCP is never group-restricted.
+	return nil, errors.New("no socket access to probe for " + addr)
+}
+
+// unixSocketPath accepts unix:///abs and unix:path.
+func unixSocketPath(addr string) (string, bool) {
+	if path, ok := strings.CutPrefix(addr, "unix://"); ok {
+		return path, true
+	}
+	return strings.CutPrefix(addr, "unix:")
+}