feat(1.1): decnet supervise batch group + systemd unit (C5)

Hosts reconcile/enrich/orchestrate/mutate in one process via the
supervision primitive: one import floor, one shared repo/DB pool instead
of 4. Static group registry (membership is architectural, not a knob);
factories lazy-import only the hosted workers. systemd unit Conflicts=
the individual units it replaces and documents the union-of-privileges
cost. Worker code unchanged — any member is extractable by editing _build_specs.

tests/cli/test_supervise.py

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""CLI surface for ``decnet supervise`` (DECNET 1.1 consolidation)."""
+from __future__ import annotations
+
+from typer.testing import CliRunner
+
+from decnet.cli import app
+from decnet.cli.supervise import _GROUPS
+
+runner = CliRunner()
+
+
+def test_supervise_is_registered():
+    result = runner.invoke(app, ["supervise", "--help"])
+    assert result.exit_code == 0
+    assert "group" in result.stdout.lower()
+
+
+def test_unknown_group_exits_2():
+    result = runner.invoke(app, ["supervise", "definitely-not-a-group"])
+    assert result.exit_code == 2
+    assert "unknown group" in result.stdout
+
+
+def test_batch_group_is_known():
+    assert "batch" in _GROUPS