feat(tcs): establish five-domain mother brain runtime

server-tools/tcs-mother-brain/guanghu-tcs-mother-brain.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=Guanghu TCS five-domain symbiotic mother brain
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=guanghu-mother-brain
+Group=guanghu-mother-brain
+WorkingDirectory=__RELEASE_ROOT__/server-tools/tcs-mother-brain
+EnvironmentFile=/etc/guanghu/persona-secrets/shared-deepseek.env
+Environment=TCS_MOTHER_BRAIN_STATE_ROOT=/var/lib/guanghu/personas/guanghu-mother-brain
+Environment=TCS_MOTHER_BRAIN_PORT=3931
+ExecStart=/usr/bin/node __RELEASE_ROOT__/server-tools/tcs-mother-brain/server.mjs
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=__RELEASE_ROOT__ /etc/guanghu/persona-secrets/shared-deepseek.env
+ReadWritePaths=/var/lib/guanghu/personas/guanghu-mother-brain
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target