…ypass the proxy (#113)

* feat(install): Linux hardening pass — service discovery, ExecStart override, CA + verify

Linux-side parity for the macOS keychain trust pass that ships in
PR #107. When a claw spec opts in via `linux_hardening=true`, the
installer:

- Discovers all agent-related services on the target via heuristics on
  `systemctl list-units --state=running` (browser binary names,
  `*claw*` description match, `node` + `OPENCLAW_*` env hints,
  operator-supplied extras).
- Writes a systemd drop-in per service. For browser services
  (`chrome-cdp` and friends), uses an ExecStart-override drop-in that
  injects `--proxy-server=...` after the binary path while preserving
  all other args verbatim — Chrome on Linux headless does not honor
  `HTTPS_PROXY` env reliably, so the explicit flag is required. For
  everything else, uses the env-only drop-in shape.
- Installs the Calciforge MITM CA into the system bundle
  (`/usr/local/share/ca-certificates/calciforge-ca.crt` +
  `update-ca-certificates`) and into Chrome's per-user NSS DB at
  `~/.pki/nssdb` via `certutil`. Detects the package manager
  (apt/dnf/yum/pacman) before installing `libnss3-tools` /
  `nss-tools`; bails with a clear error if no supported PM is found.
- Restarts services in dependency order (browsers → orchestrators →
  gateway) and asserts each becomes `active`. On failure, attaches the
  last 20 lines of journalctl output to the bail message.
- Verifies the result by `curl`-ing a known-blocked URL through the
  proxy and asserting the Calciforge block-page marker plus
  `X-Calciforge-Blocked: true` header are returned. Fails loud if any
  service still bypasses — that's the whole point of the pass.
- Audits `ss -tnp` for established :443 connections that aren't going
  to the proxy port and warns (not errors) on hits.
- Prints a prominent banner up front clarifying that Calciforge will
  not touch human-user sessions on shared hosts; opt-in for those is
  deferred to a follow-up `calciforge-trust-user` script (TODO comment
  in code).

The new module `install::linux_hardening` houses the pure logic
(ExecStart parser/rewriter, service classifier, response-block-page
detector, package-manager probe). Side-effecting parts shell out via
`SshClient`. 22 new unit tests exercise the pure functions; existing
`apply_remote_config_*` tests are untouched (the new path is gated on
the new `linux_hardening` field, default false).

Three new fields on `ClawTarget`: `linux_hardening`,
`linux_hardening_extras`, `linux_hardening_verify_url`. CLI parser
accepts `linux_hardening=true,linux_hardening_extras=foo;bar,linux_hardening_verify_url=...`
in `--claw` specs.

The macOS launchd path is untouched. Existing systemd env-only flow
(for `openclaw-gateway` only) is preserved as-is when the new opt-in
flag is not set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(install/linux-hardening): address PR #113 review feedback

Eight fixes from review:

1. Added unit tests for parse_claw_spec linux_hardening fields:
   truthy/falsy values, default-when-absent, extras split-and-trim,
   verify-url passthrough.

2. Dropped the `|| true` from `systemctl list-units`. Real failure
   here should bail loudly, not silently proceed with empty service set.

3. Discovery now uses the SAME systemctl scope (system vs user) as the
   eventual restart. Discovering against system-scope when the OpenClaw
   service is user-scope silently missed the right units.

4. Drop-ins are now written to `~/.config/systemd/user/{unit}.d/`
   when service_mode is user, instead of always `/etc/systemd/system/`.
   The system-scope path required sudo unnecessarily AND wouldn't
   affect `systemctl --user` services at all.

5. PackageManager now exposes `system_ca_anchor_dir()` per distro:
   /usr/local/share/ca-certificates (Debian), /etc/pki/ca-trust/source/anchors
   (RHEL/Fedora), /etc/ca-certificates/trust-source/anchors (Arch).
   Hardcoding Debian's path meant the trust-anchor refresh on RHEL
   never picked up the cert (silently broken on those distros).

6. Verification curl now uses `pm.system_ca_bundle_path()` per distro
   instead of hardcoded `/etc/ssl/certs/ca-certificates.crt`. Fedora's
   bundle lives at /etc/pki/tls/certs/ca-bundle.crt; verification was
   failing even when CA install had succeeded.

7. `render_exec_start_override` now escapes `\` and `"` in the
   Environment="..." values via new `systemd_environment_value` helper.
   A proxy_endpoint or no_proxy list with a quote/backslash in it was
   producing malformed drop-ins (unit fails to start at best, systemd
   directive injection at worst).

8. `*claw*` heuristic now reports which side hit (unit name vs
   description) so the audit log line matches what was actually
   matched. Comment + reason string aligned.

---------

Co-authored-by: Librarian <librarian@glusman.me>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>