feat(1.2): decnet fleet — prefork master for the heavy worker tier

Wires the prefork primitive into a CLI command. 'decnet fleet heavy' imports
the shared base floor once in the master, then forks profiler + ttp as
CoW-sharing child processes (own process/GIL, full isolation, shared ~71MB
floor). DB-only tier => systemd unit carries no extra privilege (prefork's
privilege-union cost is nil for this fleet). Unit Conflicts= the profiler/ttp
units it replaces. Heavy per-worker state (ATT&CK/ML) still loads per-child;
warming it in the master to share is deferred until a live RSS measurement
shows the big object graph CoW-shares rather than refcount-dirties.

deploy/decnet-fleet-heavy.service.j2

@@ -0,0 +1,48 @@
+[Unit]
+Description=DECNET Heavy Fleet (prefork master forking profiler + ttp as CoW-sharing children)
+Documentation=https://git.resacachile.cl/anti/DECNET/wiki/Workers#fleet
+After=network-online.target decnet-bus.service
+Wants=network-online.target decnet-bus.service
+# Replaces the individual decnet-profiler / decnet-ttp units. Do NOT enable
+# those alongside this one.
+Conflicts=decnet-profiler.service decnet-ttp.service
+
+[Service]
+Type=simple
+User={{ user }}
+Group={{ group }}
+WorkingDirectory={{ install_dir }}
+EnvironmentFile=-{{ install_dir }}/.env.local
+Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.fleet-heavy.log
+ExecStart={{ venv_dir }}/bin/decnet fleet heavy
+StandardOutput=append:/var/log/decnet/decnet.fleet-heavy.log
+StandardError=append:/var/log/decnet/decnet.fleet-heavy.log
+
+# Prefork master imports the shared base floor once, then forks one child per
+# worker; children share the floor via copy-on-write. Both members are DB-only
+# (no docker socket, no raw sockets) so this unit carries NO extra privilege —
+# the prefork privilege-union cost is nil for this fleet by construction.
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+# Security Hardening
+NoNewPrivileges=yes
+ProtectSystem=full
+# Dev installs under /home need ProtectHome=read-only: the ttp child reads
+# ./rules/ttp/ from the project root (read-only suffices — YAML reads only).
+ProtectHome=read-only
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+ReadWritePaths={{ install_dir }} /var/log/decnet
+
+Restart=on-failure
+RestartSec=5
+# Master forwards SIGTERM to children and reaps; give it room for both to drain.
+TimeoutStopSec=25
+
+[Install]
+WantedBy=multi-user.target