Install as Linux daemon

[Escoto]

Problem

Missing support for running as a system daemon. Users must manually start the process in a terminal and keep it alive themselves. There's no systemd unit, no system-wide install path, and the config search only looks in the user's home directory.

Proposed solution

• Binary install to /usr/local/bin/ via a --system flag on install.sh (per-user install remains the default).
• Layered config search chain: CLI flag > $RUSTIFYMYCLAW_CONFIG > CWD > ~/.rustifymyclaw/config.yaml > /etc/rustifymyclaw/config.yaml.
• Systemd unit file systemd/rustifymyclaw.service with security hardening: DynamicUser=yes, NoNewPrivileges=yes, ProtectSystem=strict.

Alternatives considered

• Daemonize in-process (double-fork, PID file): unnecessary complexity... The binary already runs correctly as a foreground process, and systemd handles supervision, restart, and logging natively.
• /usr/bin/ can come later with .deb/.rpm packagesg.
• Drop ~/.rustifymyclaw/ in favor of /etc/ only: per-user config is valuable for testing, and running without root. Plus standard tools (git, docker, SSH) use a simmilar approach.

Additional context

The signal handling and graceful shutdown (SIGTERM, 30s drain) already work... so, this is purely install/config/packaging infra.

[Escoto]

PR #33 came with a change on paradigm.

Using ephemeral user (DynamicUser=yes) came with several pitfalls I was not expecting.

The new install script creates a system user + group when installing as daemon.

Every time a new Workspace is added using sudo rustifymyclaw config allow-path {path} the RMC user is granted read-write permissions for the workspace. Also, parent directories get traverse permissions, otherwise the RMC can't see the workspace event with read-write granted.

Technically, the "back-ends" are executed under this user privileges (since RMC is the one calling the CLI), so, read-write permissions are important to work with agents. Even when Claude has write granted, if RMC doesn't, then Claude would be constrained.