fix: harden service provisioning and verify disposable Linux lifecycle

[makeitfutureDev]

Fresh dedicated-account installs failed when rootless Podman inherited the operator's container-storage configuration or private working directory. Provision the service image from the service-owned checkout with the explicit environment used by the daemon.

Add disposable GitHub-hosted Linux acceptance workflows for the real systemd installer, full production image, restart, encrypted fixture backup/restore, uninstall preservation and an actual Ubuntu guest OS reboot under KVM. A local-upstream fixture invokes the unmodified CLI updater against test/readiness failures and checks real Git/service rollback; engine smoke and test/pretest commands are controlled fixture inputs.

Validation on merge SHA 547ae2454d96fc038e97ae111174cebfb3bcd998:

• Linux lifecycle + real rollback: PASS. Both candidate test failure and deliberately wrong live revision rolled back Git and restarted systemd; recovery snapshot SQL/config markers and integrity passed; original candidate restored before uninstall.
• Actual guest OS reboot: PASS. OS boot ID and daemon instance changed, service automatically started, database/rootless-volume markers survived and uninstall preserved state.
• Focused operations regressions: 11/11; injected updater/state/smoke regressions: 37/37.
• Node 22.13 and Node 24 CI, hygiene and sign-off checks: PASS.

All data and passwords were synthetic fixtures in disposable VMs. No production runtime or credentials were used. Reboot happened only inside the guest, while the GitHub runner stayed alive. Authenticated Claude/Codex conversation/session gates remain unexecuted; private Airtable QA remains deferred by operator instruction. Detailed reproduction and evidence are in TEST-PLAN.md.