feat(agent): consume explicit deployment events safely

server-tools/lake-lamp-authz/lake-lamp-deployment-event-worker.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Guanghu explicit deployment event worker
+After=network-online.target lake-lamp-authz.service lake-lamp-architecture-provision.service
+
+[Service]
+Type=simple
+User=root
+Group=root
+EnvironmentFile=/etc/guanghu/secrets/lake-lamp/action-broker.env
+ExecStart=/usr/bin/node /opt/guanghu/lake-lamp-authz/deployment-event-worker.js
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/guanghu/deployment-events /var/lib/guanghu/architecture-provision /opt/guanghu/architecture-releases /etc/systemd/system
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target