feat: establish Chenglu persistent agent runtime

systemd/chenglu-agent.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Chenglu persistent persona continuity agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=chenglu-agent
+Group=chenglu-agent
+WorkingDirectory=/opt/chenglu-agent
+EnvironmentFile=-/etc/chenglu-agent/secrets.env
+ExecStart=/usr/bin/node /opt/chenglu-agent/src/server.js
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadOnlyPaths=/opt/chenglu-agent /etc/chenglu-agent/identity.key /etc/chenglu-agent/identity.pub
+ReadWritePaths=/var/lib/chenglu-agent
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target
+