feat(history): publish sanitized server watermarks

engineering/persona-history-runtime/packaging/guanghu-persona-history-publisher.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Publish sanitized Guanghu persona history watermarks
+After=network-online.target guanghu-persona-history-recovery.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=guanghu-history-publisher
+Group=guanghu-history-publisher
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/opt/guanghu/persona-history/current/guanghu_history_publisher.py --config /etc/guanghu/persona-history-publisher.json
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=6
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryMax=256M
+CPUQuota=30%
+ReadOnlyPaths=/etc/guanghu/persona-history-publisher.token
+ReadWritePaths=/var/lib/guanghu/persona-history-publisher

engineering/persona-history-runtime/packaging/guanghu-persona-history-publisher.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Low-frequency Guanghu persona history watermark publication
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=1h
+RandomizedDelaySec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target