feat(deploy): systemd unit for decnet-enrich + register in worker panel

Mirrors decnet-reuse-correlator.service.j2: same hardening posture
(NoNewPrivileges, ProtectSystem=full, etc.), same restart policy, same
log file convention. The decnet init renderer picks it up automatically
via the decnet-*.service.j2 glob.

Also reconciles a naming inconsistency I shipped earlier: the heartbeat
name was 'intel' (the package) but the CLI command and unit are 'enrich'
(the action). Renamed the heartbeat to 'enrich' so the workers panel
displays the same string the operator types and the same string in the
systemd unit file. Convention across the project: heartbeat name =
registry key = unit basename = CLI command name.

Registers 'enrich' in worker_registry.KNOWN_WORKERS and in the
start-all preferred order. The decnet.target Wants= list also picks
up the new unit so 'systemctl start decnet.target' brings everything
up together.

decnet/intel/worker.py

@@ -117,7 +117,7 @@ async def run_intel_loop(
     wake_tasks: list[asyncio.Task] = []
     heartbeat_task: Optional[asyncio.Task] = None
     try:
-        candidate = get_bus(client_name="intel")
+        candidate = get_bus(client_name="enrich")
         await candidate.connect()
         bus = candidate
         wake_tasks.append(asyncio.create_task(
@@ -127,10 +127,10 @@ async def run_intel_loop(
             _wake_on(bus, wake, _topics.attacker(_topics.ATTACKER_SCORED)),
         ))
         heartbeat_task = asyncio.create_task(
-            _run_health_heartbeat(bus, "intel"),
+            _run_health_heartbeat(bus, "enrich"),
         )
         wake_tasks.append(asyncio.create_task(
-            _run_control_listener_signal(bus, "intel"),
+            _run_control_listener_signal(bus, "enrich"),
         ))
     except Exception as exc:  # noqa: BLE001
         log.warning(