feat(swarm): per-host microservices as systemd units, mutator off agents

Previously `decnet status` on an agent showed every microservice as DOWN
because deploy's auto-spawn was unihost-scoped and the agent CLI gate
hid the per-host commands. Now:

  - collect, probe, profiler, sniffer drop out of MASTER_ONLY_COMMANDS
    (they run per-host; master-side work stays master-gated).
  - mutate stays master-only (it orchestrates swarm-wide respawns).
  - decnet/mutator/ excluded from agent tarballs — never invoked there.
  - decnet/web exclusion tightened: ship db/ + auth.py + dependencies.py
    (profiler needs the repo singleton), drop api.py, swarm_api.py,
    ingester.py, router/, templates/.
  - Four new systemd unit templates (decnet-collector/prober/profiler/
    sniffer) shipped in every enrollment tarball.
  - enroll_bootstrap.sh enables + starts all four alongside agent and
    forwarder at install time.
  - updater restarts the aux units on code push so they pick up the new
    release (best-effort — legacy enrollments without the units won't
    fail the update).
  - status table hides Mutator + API rows in agent mode.

tests/updater/test_updater_executor.py

@@ -419,11 +419,17 @@ def test_spawn_agent_via_systemd_records_main_pid(
     pid = ex._spawn_agent_via_systemd(install_dir)
     assert pid == 4711
     assert (install_dir / "agent.pid").read_text() == "4711"
-    # Agent restart, forwarder restart, then MainPID lookup on the agent.
+    # Agent restart, forwarder restart, each aux microservice, then the
+    # MainPID lookup on the agent.
     assert calls[0] == ["systemctl", "restart", ex.AGENT_SYSTEMD_UNIT]
     assert calls[1] == ["systemctl", "restart", ex.FORWARDER_SYSTEMD_UNIT]
-    assert calls[2][:2] == ["systemctl", "show"]
-    assert ex.AGENT_SYSTEMD_UNIT in calls[2]
+    aux_calls = calls[2 : 2 + len(ex.AUXILIARY_SYSTEMD_UNITS)]
+    assert aux_calls == [
+        ["systemctl", "restart", unit] for unit in ex.AUXILIARY_SYSTEMD_UNITS
+    ]
+    show_call = calls[2 + len(ex.AUXILIARY_SYSTEMD_UNITS)]
+    assert show_call[:2] == ["systemctl", "show"]
+    assert ex.AGENT_SYSTEMD_UNIT in show_call
 
 
 def test_spawn_agent_via_systemd_tolerates_missing_forwarder_unit(