feat(templates): add sessrec pty transcript recorder

New decnet/templates/_shared/sessrec/ — a small C program installed as the
login shell in SSH / Telnet deckies. Forkpty-relays /bin/bash, records each
chunk as an asciinema v2 event into a shared JSONL day-shard keyed by sid,
and emits one RFC 5424 session_recorded line on exit (direct to PID 1's
stdout, same pattern syslog_bridge.py uses).

Storage: one shard per (decky, UTC day) at
/var/lib/systemd/coredump/transcripts/sessions-YYYY-MM-DD.jsonl. Concurrent
appends are lock-free: each write is chunked below PIPE_BUF so O_APPEND
interleaves atomically. Per-session cap 10 MB with a trunc sentinel; disk-
free precheck (<200 MB) falls through to plain bash with a session_skipped
log event. Attacker src_ip resolves from \$SSH_CONNECTION, getpeername(0),
or utmp in that order. SIGWINCH appends a 'r' resize event so ncurses
replays stay aligned.

Stealth for v1: /etc/passwd shell-swap to /usr/libexec/login-session
(plausible login-machinery path) + prctl comm disguise. Full LD_PRELOAD
argv-zap is deferred — sshd strips LD_PRELOAD from the session env, so
wiring the existing argv_zap.so into this path needs a separate wrapper.

DEBT-033 opened for size-based day-shard rotation; v1's disk-free precheck
covers the worst case but can be blinded by a one-shot disk fill.

decnet/templates/_shared/sessrec/Makefile

@@ -0,0 +1,28 @@
+# Build sessrec, a tiny pty relay + transcript recorder installed as the
+# login shell inside SSH / Telnet decky containers. Built per-image during
+# the template Dockerfile's build stage; gcc + libc6-dev are installed only
+# for this step and purged in the same layer.
+#
+# Output: /usr/libexec/login-session (plausible login-machinery name)
+
+CC      ?= gcc
+CFLAGS  ?= -O2 -Wall -Wextra -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE
+LDFLAGS ?= -pie -Wl,-z,relro,-z,now
+LIBS    := -lutil
+
+PREFIX  ?= /usr/libexec
+TARGET  := login-session
+
+all: $(TARGET)
+
+$(TARGET): sessrec.c
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< $(LIBS)
+	strip --strip-unneeded $@
+
+install: $(TARGET)
+	install -D -m 0755 $(TARGET) $(DESTDIR)$(PREFIX)/$(TARGET)
+
+clean:
+	rm -f $(TARGET)
+
+.PHONY: all install clean