Add systemd unit posture checks

Close the remaining v0.8 posture bullet: flag enabled systemd units with
group/world-writable unit files (systemd_unit_writable, sid 100050) and
units whose ExecStart binary runs from a writable/unsafe path such as
/tmp, /dev/shm, /var/tmp, /home, or /run/user (systemd_exec_unsafe_path,
sid 100051).

- posture.systemd_findings/parse_systemctl_show/read_systemd_units, wired
  into posture.run() behind the new posture_systemd config knob.
- read_systemd_units shells out to systemctl with timeouts and fails closed
  on non-systemd hosts; the dashboard /api/posture surfaces findings for free.
- Unit tests for the parser and evaluator; TestRunIntegration patches the
  new reader so run() never touches live systemctl.
- Docs: COMMAND_REFERENCE posture list, ROADMAP v0.8 bullet, RUNBOOKS
  Runbook 2 triggers, config TOML knob.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/enodia-sentinel.toml

@@ -151,6 +151,10 @@ posture_sshd_config = "/etc/ssh/sshd_config"
 posture_sudoers = "/etc/sudoers"
 posture_sudoers_dir = "/etc/sudoers.d"
 # posture_path = []               # PATH dirs to audit; empty = safe default set
+# Audit enabled systemd service units (writable unit files, ExecStart binaries
+# in writable/unsafe paths). Shells out to systemctl with timeouts and fails
+# closed on non-systemd hosts; set false to skip the systemctl calls entirely.
+posture_systemd = true
 
 # --- eBPF event layer ----------------------------------------------------
 # Event-driven eBPF monitors: catch short-lived activity the poll loop misses.