Add systemd unit posture checks

Close the remaining v0.8 posture bullet: flag enabled systemd units with
group/world-writable unit files (systemd_unit_writable, sid 100050) and
units whose ExecStart binary runs from a writable/unsafe path such as
/tmp, /dev/shm, /var/tmp, /home, or /run/user (systemd_exec_unsafe_path,
sid 100051).

- posture.systemd_findings/parse_systemctl_show/read_systemd_units, wired
  into posture.run() behind the new posture_systemd config knob.
- read_systemd_units shells out to systemctl with timeouts and fails closed
  on non-systemd hosts; the dashboard /api/posture surfaces findings for free.
- Unit tests for the parser and evaluator; TestRunIntegration patches the
  new reader so run() never touches live systemctl.
- Docs: COMMAND_REFERENCE posture list, ROADMAP v0.8 bullet, RUNBOOKS
  Runbook 2 triggers, config TOML knob.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/COMMAND_REFERENCE.md

@@ -262,6 +262,11 @@ attack, as opposed to an attack in progress:
   group/world-writable sudoers files.
 - World-writable or non-root-owned `PATH` directories (binary-hijack vectors).
 - Loose permissions on sensitive files (`/etc/shadow`, `/etc/passwd`, ...).
+- Enabled systemd units with group/world-writable unit files, or whose
+  `ExecStart` binary runs from a writable/unsafe path (`/tmp`, `/dev/shm`,
+  `/var/tmp`, `/home`, `/run/user`) — a common persistence/hijack vector.
+  Shells out to `systemctl` with timeouts and fails closed on non-systemd
+  hosts; disable with `posture_systemd = false`.
 - Downgraded package-signature policy (`SigLevel`).
 
 Findings are advisory and reuse the standard alert JSON shape (`--json`). This

docs/ROADMAP.md

@@ -31,9 +31,9 @@ work that is bigger than single alerts.
 - ✅ Add `enodia-sentinel incident list/show/export`.
 - ✅ Add host posture checks (`enodia-sentinel posture check`):
   SSH root/password/empty-password login, passwordless and writable sudoers,
-  world-writable PATH components, loose sensitive-file permissions, and disabled
-  package signatures. Still to come: unexpected enabled services and unsafe
-  systemd unit settings.
+  world-writable PATH components, loose sensitive-file permissions, disabled
+  package signatures, and enabled systemd units with writable unit files or
+  `ExecStart` binaries in writable/unsafe paths.
 - ✅ Add a machine-readable `status --json` command for automation.
 - ✅ Update the red-team harness so every current detection has a named drill and
   expected `sid` (`sentinel-redteam --list`), with a PASS/MISS verification pass.

docs/RUNBOOKS.md

@@ -94,7 +94,7 @@ detector.
 ## Runbook 2 — Persistence tampering
 
 **Triggers:** `persistence` (sid 100015), `fim_modified` on a watched persistence
-path.
+path, `systemd_unit_writable` (sid 100050), `systemd_exec_unsafe_path` (sid 100051).
 
 A change to cron, a systemd unit, an SSH `authorized_keys`, a shell rc file, or
 sudo/account config — how an attacker survives a reboot.