Slice 2: agents and control plane run under systemd

- systemd/sdp-control-plane.service: plain host process on 186,
  listens on :3452, data dir ~/SDP/data. MemoryMax=512M,
  Restart=always, ReadWritePaths scoped to the data dir.
- systemd/sdp-agent-micro.service: plain host process on 92,
  default SDP_CP_URL=ws://172.18.139.186:3452/ws/agent. Operator
  can drop /etc/default/sdp-agent-micro to override. Depends on
  docker.service so the dockerd is up before the agent starts.
- systemd/sdp-agent-gateway.service: plain host process on 186,
  default SDP_CP_URL=ws://127.0.0.1:3452/ws/agent (loopback since
  both live on the same VM). Same env-file override pattern.
- All three use Type=simple, Restart=always, RestartSec=2s. The
  agents already reconnect on transient network drops, so
  restart-on-crash is the right policy.
- The agents talk to the host dockerd via /var/run/docker.sock to
  spawn the actual service containers (sdp-<repo>). Service
  containers are managed by docker, not systemd — only the
  long-running agents and the control plane are under systemd.
- scripts/deploy.sh: now a one-shot — scp's binaries, dashboard,
  and unit files; systemctl daemon-reload + enable --now + restart
  each service in the right order (control plane first on 186 so
  the gateway agent has something to dial). Prints status + last
  10 journal lines per service so the user can see it came up.
- AGENTS.md, README.md: layout tree updated, deploy section
  rewritten, the systemd units documented alongside the agents
  and control plane.

systemd/sdp-agent-gateway.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=SDP gateway agent
+Documentation=https://github.com/sdp
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=simple
+User=administrator
+WorkingDirectory=/home/administrator
+# SDP_CP_URL points at the control plane. Default is the production
+# topology (both on 186, dialed over loopback). Override by creating
+# /etc/default/sdp-agent-gateway with `SDP_CP_URL=...`.
+Environment=SDP_CP_URL=ws://127.0.0.1:3452/ws/agent
+EnvironmentFile=-/etc/default/sdp-agent-gateway
+ExecStart=/home/administrator/SDP/bin/agent-gateway -node gateway -cp ${SDP_CP_URL}
+Restart=always
+RestartSec=2s
+
+MemoryMax=256M
+
+[Install]
+WantedBy=multi-user.target

systemd/sdp-agent-micro.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=SDP micro agent
+Documentation=https://github.com/sdp
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=simple
+User=administrator
+WorkingDirectory=/home/administrator
+# SDP_CP_URL points at the control plane. Default is the production
+# topology (control plane on 186, micro agent on 92). Override by
+# creating /etc/default/sdp-agent-micro with `SDP_CP_URL=...`.
+Environment=SDP_CP_URL=ws://172.18.139.186:3452/ws/agent
+EnvironmentFile=-/etc/default/sdp-agent-micro
+ExecStart=/home/administrator/SDP/bin/agent-micro -node micro -cp ${SDP_CP_URL}
+Restart=always
+RestartSec=2s
+
+MemoryMax=256M
+
+[Install]
+WantedBy=multi-user.target

systemd/sdp-control-plane.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=SDP control plane
+Documentation=https://github.com/sdp
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=administrator
+WorkingDirectory=/home/administrator
+ExecStart=/home/administrator/SDP/bin/control-plane -addr :3452 -data /home/administrator/SDP/data
+Restart=always
+RestartSec=2s
+
+# Cap memory at 512M. The control plane only holds SQLite + log files;
+# anything beyond is a leak.
+MemoryMax=512M
+
+# Allow the process to write to its data dir.
+ReadWritePaths=/home/administrator/SDP/data
+
+[Install]
+WantedBy=multi-user.target