Slice 2: agents and control plane run under systemd

- systemd/sdp-control-plane.service: plain host process on 186,
  listens on :3452, data dir ~/SDP/data. MemoryMax=512M,
  Restart=always, ReadWritePaths scoped to the data dir.
- systemd/sdp-agent-micro.service: plain host process on 92,
  default SDP_CP_URL=ws://172.18.139.186:3452/ws/agent. Operator
  can drop /etc/default/sdp-agent-micro to override. Depends on
  docker.service so the dockerd is up before the agent starts.
- systemd/sdp-agent-gateway.service: plain host process on 186,
  default SDP_CP_URL=ws://127.0.0.1:3452/ws/agent (loopback since
  both live on the same VM). Same env-file override pattern.
- All three use Type=simple, Restart=always, RestartSec=2s. The
  agents already reconnect on transient network drops, so
  restart-on-crash is the right policy.
- The agents talk to the host dockerd via /var/run/docker.sock to
  spawn the actual service containers (sdp-<repo>). Service
  containers are managed by docker, not systemd — only the
  long-running agents and the control plane are under systemd.
- scripts/deploy.sh: now a one-shot — scp's binaries, dashboard,
  and unit files; systemctl daemon-reload + enable --now + restart
  each service in the right order (control plane first on 186 so
  the gateway agent has something to dial). Prints status + last
  10 journal lines per service so the user can see it came up.
- AGENTS.md, README.md: layout tree updated, deploy section
  rewritten, the systemd units documented alongside the agents
  and control plane.

AGENTS.md

@@ -7,7 +7,7 @@ The build script is the only way to compile — local Go can't fetch the
 
 ```
 ./scripts/build.sh        # cross-compiles 3 Go binaries + builds the Next.js dashboard
-./scripts/deploy.sh       # SSHes the artifacts to 92 and 186; needs sshpass
+./scripts/deploy.sh       # SSHes artifacts + systemd units to 92 and 186, then enables+starts them; needs sshpass
 ```
 
 The script uses a `golang:1.24-alpine` container with a persistent
@@ -51,6 +51,13 @@ Five Go modules in a workspace (`go.work`):
 - `agent-micro/` — runs on 172.18.136.92.
 - `agent-gateway/` — runs on 172.18.139.186; owns erangel at
   `/var/www/html/erangel-ocean` and the `<service>_url` patching.
+- `systemd/` — unit files for the three long-running services
+  (`sdp-control-plane.service`, `sdp-agent-micro.service`,
+  `sdp-agent-gateway.service`). All three are plain host processes
+  managed by systemd; the agents talk to the host's dockerd via
+  `/var/run/docker.sock` to spawn the actual service containers
+  (`sdp-<repo>`) for each deploy. Service containers are NOT
+  managed by systemd — that's docker's job.
 
 Dashboard is a separate `next build` static export under
 `dashboard/src/app/`. Static export means dynamic routes need