machined: system-tier machine identity daemon

The machine seed moves out of the user session: souveraine-machined owns
/var/lib/souveraine/seed-id as the souveraine system user and serves
pubkey/sign over /run/souveraine/machined.sock (SO_PEERCRED logged,
domain-separated signatures, group-gated socket). Seed is a precondition
- provision via 'souveraine machine init --fresh|--migrate-from', the
daemon never generates. reach/consult now resolves the machine key
through the daemon with a loud legacy fallback. Hardened system unit +
sysusers shipped in the Arch package.

Cargo.toml

@@ -102,6 +102,8 @@ keyring-core = "1"
 ed25519-dalek = { version = "2", features = ["rand_core", "pem"] }
 sha2 = "0.10"
 rand = "0.8"
+# SO_PEERCRED on the machined socket — the daemon logs who asked for what
+libc = "0.2"
 
 # Cron expression parsing (schedule system)
 cron = "0.13"
@@ -179,6 +181,12 @@ name = "souveraine-secrets"
 path = "src/bin/souveraine-secrets.rs"
 required-features = ["secrets"]
 
+# System-tier machine identity daemon. No feature gate: zero new heavy deps,
+# and the phone package should always ship it.
+[[bin]]
+name = "souveraine-machined"
+path = "src/bin/souveraine-machined.rs"
+
 [profile.release]
 opt-level = 3
 lto = true