machined: system-tier machine identity daemon

The machine seed moves out of the user session: souveraine-machined owns
/var/lib/souveraine/seed-id as the souveraine system user and serves
pubkey/sign over /run/souveraine/machined.sock (SO_PEERCRED logged,
domain-separated signatures, group-gated socket). Seed is a precondition
- provision via 'souveraine machine init --fresh|--migrate-from', the
daemon never generates. reach/consult now resolves the machine key
through the daemon with a loud legacy fallback. Hardened system unit +
sysusers shipped in the Arch package.

packaging/arch/PKGBUILD

@@ -34,5 +34,15 @@ package() {
     # runs the pacman-owned binary
     sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' packaging/souveraine.service \
         | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
+
+    # System tier: machine identity daemon + its service user. pacman runs
+    # systemd-sysusers on install, so the `souveraine` user exists before
+    # anyone runs `souveraine machine init`.
+    install -Dm755 target/release/souveraine-machined "$pkgdir/usr/bin/souveraine-machined"
+    install -Dm644 packaging/souveraine-machined.service \
+        "$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
+    install -Dm644 packaging/arch/souveraine.sysusers \
+        "$pkgdir/usr/lib/sysusers.d/souveraine.conf"
+
     install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }

packaging/arch/souveraine.sysusers

@@ -0,0 +1,5 @@
+# The `souveraine` system user owns the machine's system tier: the machine
+# seed (/var/lib/souveraine) and the machined socket (/run/souveraine).
+# Session users join the group to talk to the daemon:
+#   usermod -aG souveraine <user>
+u souveraine - "SouveraineOS system tier" /var/lib/souveraine -

packaging/souveraine-machined.service

@@ -0,0 +1,54 @@
+# Souveraine machine identity — SYSTEM unit (contrast souveraine.service,
+# which is a user unit). Runs from boot, before any human authenticates;
+# owns the machine seed and serves signatures over a Unix socket.
+#
+# Access control is the socket: /run/souveraine (0750 souveraine:souveraine)
+# + machined.sock (0660). Add session users to the `souveraine` group:
+#   usermod -aG souveraine <user>
+#
+# Provision the seed before first start:
+#   sudo souveraine machine init --fresh
+#   sudo souveraine machine init --migrate-from /home/<user>/.souveraine/seed-id
+[Unit]
+Description=Souveraine machine identity (system tier)
+
+[Service]
+User=souveraine
+Group=souveraine
+ExecStart=/usr/bin/souveraine-machined
+Restart=on-failure
+RestartSec=5
+
+# /var/lib/souveraine — the seed. /run/souveraine — the socket.
+StateDirectory=souveraine
+StateDirectoryMode=0700
+RuntimeDirectory=souveraine
+RuntimeDirectoryMode=0750
+UMask=0007
+
+# Network-less signer, RedFlag-executor posture: nothing to reach, nothing
+# reachable. AF_UNIX only, no privileges, no writable system.
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX
+IPAddressDeny=any
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target