[process-manager PM-15] systemd renderer knobs: Type=notify, WatchdogSec, hardening, cgroups v2

[rickylabs]

Summary

Extend the shipped systemd renderer: Type=notify/WatchdogSec, HARDENING_BASELINE profile, DynamicUser, cgroups v2 resource limits — with byte-identical rendering when the new knobs are unset (no regression for shipped users).

Scope

• Archetype / area: systemd renderer (today packages/cli; moves to packages/deploy-core at PM-20)
• Part of Epic: NetScript Process Manager — bare-metal supervisor + admin console (pup/pm2 done right) #510
• Depends on: [process-manager PM-1] Process-graph contract v1 (ProcessGraphShape/ProcessSpecShape + state vocabulary + restart policies) #512 · Blocks: PM-16, PM-19

Design source

• research/design/d3-deploy-integration-os-adapters.md §D3.3 (D3-S2) · plan.md §4 PM-15

Acceptance criteria

• gate: byte-identical render check — unset config renders today's unit byte-for-byte
• gate: each knob covered by a render test; hardening profile opt-in
• gate: scoped check/lint/fmt wrappers green (--ext ts,tsx)

Non-scope

• sd_notify client helper (PM-16); Servy parity where no equivalent exists (warn-and-omit via PM-17).

Drift / Debt

• none

RFC #820 amendment (owner-ratified 2026-07-17 — PR #822)

• gate: renderer knobs added — KillMode=control-group, Requires=, Type=oneshot, RemainAfterExit (byte-identical when unset). INTERNAL render mechanism (the public knob surface is deploy.targets config); classification re-decided at the PM-20 move.