feat: ship an opt-in Linux service example

[domcyrus]

Replaces #601 after its incorrect base-branch push; no service changes reached main. Stacked on #602 and related to #9.

• Ships an opt-in Linux systemd example and English, Chinese, and Japanese guides as documentation. Package installation never enables or starts the service.
• Preserves sandboxing, root-to-nobody dropping, and private output. Documents snapshot-history limits, separate PCAP files, export-error checks, and capture preservation before restart.
• Retains package inspections and real systemd privilege-drop/SIGTERM checks. No new runtime engine or service platforms; Windows SCM, launchd, and FreeBSD services remain deferred.

[domcyrus]

Updated to 792c3d8 with the verified headless parent, without rewriting history.

• Service guides now distinguish sampled JSONL from packet records and explain separate PCAP paths, export-error checks, and preserving captures before restart in all three languages.
• Engine and test sources match the tested headless parent. Service source checks and all three packaging-script tests passed locally. All final-head CI passed, including Windows, FreeBSD, package inspections and the real systemd smoke test.
• The unit remains opt-in documentation. No service was installed or enabled, and no PR was merged into main.

Exact-head Linux build and 40 focused startup/headless tests passed. A direct headless smoke matched all 399,744 generated datagrams in independent and RustNet PCAPs, with zero reported drops/export errors and a clean terminal record. This does not establish losslessness for arbitrary workloads.