[OC-059] Ship and verify the hardened user service

[tcballard]

Gate: G5 — Packaging, hardening, and release

Planning source: validated implementation plan PR #1

---

• Depends on: OC-007, OC-025, OC-058.
• Deliverable: omachatd.service with runtime/state paths and applicable systemd hardening, plus explicit linger setup/removal documentation.
• Acceptance: clean Omarchy v4.0.1 install starts in-session; optional owner-enabled linger works across logout/reboot; suspend limitations are documented; service receives only intended writable paths.
• Excludes: silently enabling linger in package scripts.

Maintainer reconciliation — 2026-09-04

Next closure evidence/work: Run clean Omarchy lifecycle, writable-path and explicit owner-enabled linger tests; investigate graceful SIGTERM with #26.

Baseline reviewed: main 87c3bcb7d65e3e2ab8ae317694b751f8efe9a8ed. Implementation presence is not a live conformance claim.