chore(systemd): add units for collector/profiler/sniffer/prober/mutator + decnet.target

Adds the five missing worker units plus a grouping target so
`systemctl start decnet.target` brings the whole fleet up in order.
Sniffer gets CAP_NET_RAW for scapy; collector and mutator join the
docker supplementary group for docker.sock access. Repoints
Documentation= across all existing units to the canonical
git.resacachile.cl wiki.

deploy/decnet-mutator.service

@@ -0,0 +1,38 @@
+[Unit]
+Description=DECNET Mutator (runtime fleet mutation watch loop)
+Documentation=https://git.resacachile.cl/anti/DECNET/wiki/Workers#mutator
+After=network-online.target docker.service decnet-bus.service
+Wants=network-online.target decnet-bus.service
+Requires=docker.service
+
+[Service]
+Type=simple
+User=decnet
+Group=decnet
+# Mutator recomposes decky services via docker compose.
+SupplementaryGroups=docker
+WorkingDirectory=/opt/decnet
+EnvironmentFile=-/opt/decnet/.env.local
+ExecStart=/opt/decnet/venv/bin/decnet mutate --watch
+
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+# Security Hardening
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+ReadWritePaths=/opt/decnet /var/log/decnet
+
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=15
+
+[Install]
+WantedBy=multi-user.target