feat(zhulan): add restricted remote development cell

server-tools/zhulan-remote-cell/deploy/zhulan-remote-cell.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=Guanghu Zhulan Restricted Remote Development Cell
+After=network-online.target zhulan-validation-executor.service
+Wants=network-online.target
+Requires=zhulan-validation-executor.service
+
+[Service]
+Type=simple
+User=zhulan-runtime
+Group=zhulan-runtime
+EnvironmentFile=/etc/guanghu/zhulan-remote-cell.env
+ExecStart=/usr/bin/python3 /opt/guanghu/zhulan-remote-cell/runtime/zhulan_cell.py
+Restart=on-failure
+RestartSec=3
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=user mnt pid net ipc uts
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+ReadOnlyPaths=/opt/guanghu/zhulan-remote-cell /etc/guanghu/zhulan-remote-cell.env /etc/guanghu/secrets/zhulan-remote-cell.secret
+ReadWritePaths=/var/lib/guanghu/zhulan-remote-cell
+ReadWritePaths=/srv/guanghu/zhulan-cell/workspaces
+ReadWritePaths=/srv/guanghu/zhulan-cell/candidates
+StateDirectory=guanghu/zhulan-remote-cell
+
+[Install]
+WantedBy=multi-user.target