feat(zhulan): add restricted remote development cell

server-tools/zhulan-remote-cell/deploy/zhulan-validation-executor.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=Zhulan local-only allowlisted validation executor
+After=local-fs.target
+Before=zhulan-remote-cell.service
+
+[Service]
+Type=simple
+User=zhulan-runtime
+Group=zhulan-runtime
+EnvironmentFile=/etc/guanghu/zhulan-remote-cell.env
+ExecStart=/usr/bin/python3 /opt/guanghu/zhulan-remote-cell/runtime/zhulan_validation_executor.py
+Restart=always
+RestartSec=3
+UMask=0077
+PrivateTmp=true
+PrivateDevices=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=user mnt pid net ipc uts
+SystemCallArchitectures=native
+RuntimeDirectory=guanghu/zhulan-validation
+RuntimeDirectoryMode=0700
+ReadOnlyPaths=/opt/guanghu/zhulan-remote-cell /etc/guanghu/zhulan-remote-cell.env
+ReadOnlyPaths=/srv/guanghu/zhulan-cell/workspaces
+InaccessiblePaths=/etc/guanghu/secrets
+ReadOnlyPaths=/var/lib/guanghu/zhulan-remote-cell
+InaccessiblePaths=/srv/guanghu/zhulan-cell/candidates
+
+[Install]
+WantedBy=multi-user.target