Add declarative writable paths to Linux service deploys

[PrzemyslawKlys]

Summary

• add optional SYSTEMD_READ_WRITE_PATHS to the reusable Linux service promoter
• manage a PowerForge-owned systemd drop-in for hardened ProtectSystem=strict services
• validate trusted configuration, service, release, systemd, transaction, staging, lock, and writable-path roots before privileged mutation
• reject release/control-plane overlap, symlink redirection, traversal, globbing, and systemd-special paths
• serialize deployments by stable service id, systemd unit, and canonical service root, including recorded identities during recovery
• persist the prior unit, service root, systemd configuration root, drop-in metadata, and current-release target before mutation
• recover the exact service transaction before reading current configuration, and detect pending foreign transactions through shared unit or canonical-root identity
• fail closed on ambiguous recovery only after acquiring every service/unit/root owner lock; active owners are never interrupted
• reconcile permissions immediately beside the atomic release switch, flush service and separately mounted release filesystems, and propagate durability failures before recovery state can be discarded
• retain a recognizable committed marker until the transaction-directory rename is durable and clear it safely on this or the next invocation
• transactionally restore prior permissions and release links, preserving owner/group/mode and stopping recorded services when safety cannot be proven
• handle termination signals explicitly without crossing the durable commit boundary or reporting false success

This keeps application deployments immutable while allowing explicitly declared product data directories to remain writable. Product repositories continue to use the shared deployment action/workflow without adding SSH or service-specific release logic.

Host setup

SERVICE_ROOT, service-account-owned mutable data directories, and the root-only PowerForge staging/transaction directories are explicitly provisioned on a fresh host. The documented privileged filesystem boundary includes the owned systemd drop-in, normal Unix ownership requirements, recovery state, and committed-marker replay.

Validation

• Linux promoter integration suite passed in WSL, including fresh/repeated deployment, recovery with missing current config, unit/systemd-root changes, canonical root aliases, cross-service shared resources, ambiguous-owner locking and deduplicated stopping, committed-marker replay, unavailable recorded roots, protected-root overlap, release boundaries, symlink/trust, competing locks, signals, durability sync, rollback state, retained mode/transactions, and failed reloads
• ShellCheck passed for the promoter and integration suite
• focused workflow/action contract tests passed 6/6
• independent local review, targeted confirmations, owner-level completion audits, and all reproduced hosted-review defect-class sweeps completed
• live TierBridge private-preview publication proved the hardened-service storage scenario after the equivalent production boundary was applied

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb4bded12d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca7783b708

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26ec01c3fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73b2be9d91

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7ffc38a212

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a717ea78d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca05310545

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".