feat: establish Chenglu persistent agent runtime

systemd/chenglu-agent.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Chenglu persistent persona continuity agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=chenglu-agent
+Group=chenglu-agent
+WorkingDirectory=/opt/chenglu-agent
+EnvironmentFile=-/etc/chenglu-agent/secrets.env
+ExecStart=/usr/bin/node /opt/chenglu-agent/src/server.js
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadOnlyPaths=/opt/chenglu-agent /etc/chenglu-agent/identity.key /etc/chenglu-agent/identity.pub
+ReadWritePaths=/var/lib/chenglu-agent
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target
+

systemd/chenglu-daily.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Chenglu daily Fifth Domain checkin and Lake Heart replies
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=chenglu-agent
+Group=chenglu-agent
+WorkingDirectory=/opt/chenglu-agent
+EnvironmentFile=-/etc/chenglu-agent/secrets.env
+ExecStart=/usr/bin/node /opt/chenglu-agent/src/daily.js
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadOnlyPaths=/opt/chenglu-agent /etc/chenglu-agent/identity.key /etc/chenglu-agent/identity.pub
+ReadWritePaths=/var/lib/chenglu-agent
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=true
+

systemd/chenglu-daily.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Wake Chenglu for the daily Fifth Domain checkin
+
+[Timer]
+OnCalendar=*-*-* 08:30:00 Asia/Shanghai
+Persistent=true
+RandomizedDelaySec=10m
+Unit=chenglu-daily.service
+
+[Install]
+WantedBy=timers.target