feat(guanghu-os): stage independent Forgejo continuity

product-source/hololake-platform/guanghu-os/packaging/systemd/guanghu-independent-forgejo-shadow.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=Independent full Forgejo shadow for JD native service continuity
+After=network.target
+
+[Service]
+Type=simple
+User=guanghu-code-shadow
+Group=guanghu-code-shadow
+WorkingDirectory=/var/lib/guanghu-code-shadow
+ExecStart=/var/lib/guanghu-code-shadow/bin/forgejo web --work-path /var/lib/guanghu-code-shadow --config /etc/guanghu-os/forgejo-shadow/app.ini
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ReadOnlyPaths=/etc/guanghu-os/forgejo-shadow
+ReadWritePaths=/var/lib/guanghu-code-shadow
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictSUIDSGID=yes
+LockPersonality=yes
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target