feat(wake): W7 A10 idempotent installer + mosaic-wake.service (component-manifest, Gate-A, blank-reset retire, snapshot-guard, fail-closed install-validate) (#911)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/systemd/user/mosaic-wake.service

@@ -0,0 +1,31 @@
+[Unit]
+# Mosaic wake DETECTOR daemon (A1/W7 of the wake canon, EPIC #892). A LONG-LIVED
+# single-instance detector: tools/wake/detector.sh run. This is a SERVICE, not a
+# timer — the per-class SLO lives INSIDE the daemon's run-loop (WAKE_DETECTOR_INTERVAL
+# poll cadence + the per-cycle off-host beacon emit), never as a systemd
+# OnUnitActiveSec interval. The blank-reset cadence idiom therefore does NOT apply
+# to this unit; it applies only to the legacy mosaic-heartbeat@ timer during retire.
+Description=Mosaic wake detector daemon (framework tools/wake/detector.sh run)
+After=default.target
+
+[Service]
+Type=simple
+# Strip loader / noninteractive-shell controls before ExecStart, matching the
+# lease-broker and tmux fleet units in this same directory (defense-in-depth
+# against an injected BASH_ENV/ENV/LD_PRELOAD in the user manager environment).
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
+# Operator-owned runtime configuration. This EnvironmentFile carries only the
+# WAKE_* NAMES and the pluggable adapter COMMANDS (the off-host beacon/alarm sink
+# and the HMAC key NAME) — NEVER the HMAC key material and NEVER the alarm
+# endpoint value. Both are resolved BY NAME at runtime via load_credentials, so
+# no secret and no endpoint is ever written into this unit. The installer's
+# fail-closed install-validate (wake-install.sh validate-targets) is what proves
+# the required names are configured + reachable BEFORE this unit is enabled; the
+# '-' prefix keeps a missing file from masking that dedicated validation.
+EnvironmentFile=-%h/.config/mosaic/wake/detector.env
+ExecStart=/bin/bash --noprofile --norc %h/.config/mosaic/tools/wake/detector.sh run
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target