feat(deploy): systemd units for identity + campaign clusterers

decnet-clusterer.service.j2 ships the identity clusterer that
landed last session (was overlooked) — bus-woken on attacker.>,
publishes identity.> events.

decnet-campaign-clusterer.service.j2 ships the campaign clusterer
from this session — bus-woken on identity.>, publishes campaign.>
events plus the cross-family identity.campaign.assigned. After=
decnet-clusterer.service so the identity layer is up before the
campaign layer reads its rows.

decnet.target Wants both new units. Both follow the same security
hardening profile as enrich + reuse-correlator.

deploy/decnet.target

@@ -15,6 +15,8 @@ Wants=decnet-bus.service \
       decnet-mutator.service \
       decnet-reuse-correlator.service \
       decnet-enrich.service \
+      decnet-clusterer.service \
+      decnet-campaign-clusterer.service \
       decnet-webhook.service
 After=decnet-bus.service