machined: system-tier machine identity daemon

The machine seed moves out of the user session: souveraine-machined owns
/var/lib/souveraine/seed-id as the souveraine system user and serves
pubkey/sign over /run/souveraine/machined.sock (SO_PEERCRED logged,
domain-separated signatures, group-gated socket). Seed is a precondition
- provision via 'souveraine machine init --fresh|--migrate-from', the
daemon never generates. reach/consult now resolves the machine key
through the daemon with a loud legacy fallback. Hardened system unit +
sysusers shipped in the Arch package.

packaging/arch/PKGBUILD

@@ -34,5 +34,15 @@ package() {
     # runs the pacman-owned binary
     sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' packaging/souveraine.service \
         | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
+
+    # System tier: machine identity daemon + its service user. pacman runs
+    # systemd-sysusers on install, so the `souveraine` user exists before
+    # anyone runs `souveraine machine init`.
+    install -Dm755 target/release/souveraine-machined "$pkgdir/usr/bin/souveraine-machined"
+    install -Dm644 packaging/souveraine-machined.service \
+        "$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
+    install -Dm644 packaging/arch/souveraine.sysusers \
+        "$pkgdir/usr/lib/sysusers.d/souveraine.conf"
+
     install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }

packaging/arch/souveraine.sysusers

@@ -0,0 +1,5 @@
+# The `souveraine` system user owns the machine's system tier: the machine
+# seed (/var/lib/souveraine) and the machined socket (/run/souveraine).
+# Session users join the group to talk to the daemon:
+#   usermod -aG souveraine <user>
+u souveraine - "SouveraineOS system tier" /var/lib/souveraine -