Scoped rule — matches only `decnet-<name>.service` and `decnet.target`. Any unit outside that regex falls through to the default polkit policy. Required so the API (running as the `decnet` user) can invoke `systemctl start decnet-<name>.service` non-interactively.