feat(enroll): decnet-updater now runs under systemd, not a --daemon fork

Bootstrap used to end with `decnet updater --daemon` which forks and
detaches — invisible to systemctl, no auto-restart, dies on reboot.
Ships a decnet-updater.service template matching the pattern of the
other units (Restart=on-failure, log to /var/log/decnet/decnet.updater.log,
certs from /etc/decnet/updater, install tree at /opt/decnet), bundles
it alongside agent/forwarder/engine units, and the installer now
`systemctl enable --now`s it when --with-updater is set.

decnet/web/router/swarm_mgmt/api_enroll_bundle.py

@@ -250,7 +250,7 @@ def _build_tarball(
     return buf.getvalue()
 
 
-_SYSTEMD_UNITS = ("decnet-agent", "decnet-forwarder", "decnet-engine")
+_SYSTEMD_UNITS = ("decnet-agent", "decnet-forwarder", "decnet-engine", "decnet-updater")
 
 
 def _render_systemd_unit(name: str, agent_name: str, master_host: str) -> bytes:

decnet/web/templates/decnet-updater.service.j2

@@ -0,0 +1,18 @@
+[Unit]
+Description=DECNET self-updater (accepts tarball pushes from master) — {{ agent_name }}
+Documentation=https://github.com/anti/DECNET
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/decnet
+Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.updater.log
+ExecStart=/usr/local/bin/decnet updater --updater-dir /etc/decnet/updater --install-dir /opt/decnet --agent-dir /etc/decnet/agent
+Restart=on-failure
+RestartSec=5
+StandardOutput=append:/var/log/decnet/decnet.updater.log
+StandardError=append:/var/log/decnet/decnet.updater.log
+
+[Install]
+WantedBy=multi-user.target

decnet/web/templates/enroll_bootstrap.sh.j2

@@ -58,10 +58,15 @@ echo "[DECNET] installing systemd units..."
 install -Dm0644 etc/systemd/system/decnet-agent.service /etc/systemd/system/decnet-agent.service
 install -Dm0644 etc/systemd/system/decnet-forwarder.service /etc/systemd/system/decnet-forwarder.service
 install -Dm0644 etc/systemd/system/decnet-engine.service /etc/systemd/system/decnet-engine.service
-systemctl daemon-reload
-systemctl enable --now decnet-agent.service decnet-forwarder.service
-
 if [[ "$WITH_UPDATER" == "true" ]]; then
-  /usr/local/bin/decnet updater --daemon
+  install -Dm0644 etc/systemd/system/decnet-updater.service /etc/systemd/system/decnet-updater.service
 fi
-echo "[DECNET] agent {{ agent_name }} enrolled -> {{ master_host }}. Units: decnet-agent, decnet-forwarder active."
+systemctl daemon-reload
+
+ACTIVE_UNITS=(decnet-agent.service decnet-forwarder.service)
+if [[ "$WITH_UPDATER" == "true" ]]; then
+  ACTIVE_UNITS+=(decnet-updater.service)
+fi
+systemctl enable --now "${ACTIVE_UNITS[@]}"
+
+echo "[DECNET] agent {{ agent_name }} enrolled -> {{ master_host }}. Units: ${ACTIVE_UNITS[*]} active."