projection: begin the exact-path public epoch

The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally.

Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba

Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba

Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f

installer/linux/systemd/redflag-agent.service

@@ -0,0 +1,48 @@
+[Unit]
+Description=RedFlag Security Agent
+After=network.target
+StartLimitBurst=5
+StartLimitIntervalSec=60
+
+[Service]
+Type=simple
+User=redflag-agent
+Group=redflag-agent
+SupplementaryGroups=redflag-local
+WorkingDirectory=/var/lib/redflag/agent
+# /usr/local/bin, not the packaged /usr/bin path: the helper performs the
+# self-update binary swap at the agent's compiled-in install path
+# (agent/internal/constants/paths.go GetBinaryInstallDir), and the unit must
+# execute whatever was swapped in. postinst maintains the symlink.
+ExecStart=/usr/local/bin/redflag-agent
+Restart=always
+RestartSec=30
+RestartPreventExitStatus=255
+
+# Security hardening. NoNewPrivileges is deliberately absent: the agent's only
+# privileged path is a fixed sudo systemd-run helper invocation.
+# /usr/local/bin is writable so the helper's self-update swap can land;
+# ProtectSystem=strict is not bypassed by sudo (same mount namespace).
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/redflag /etc/redflag /var/log/redflag /usr/local/bin
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+# ProtectControlGroups left at its default: systemd-run needs cgroup creation.
+
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+
+# CAP_SYS_PTRACE: /proc/<pid>/environ reads for display/session discovery.
+# Ambient so a self-upgraded binary keeps it without file capabilities.
+# No CapabilityBoundingSet: narrowing it strips CAP_SETUID from sudo.
+AmbientCapabilities=CAP_SYS_PTRACE
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=redflag-agent
+
+[Install]
+WantedBy=multi-user.target