feat(cli): support Linux listener services

[KenTaniguchi-R]

Summary

• add a platform-neutral listener lifecycle with a systemd user service on Linux
• add a non-root container listener with an isolated named home and read-only project mount
• extend packed npm consumer CI to Ubuntu and make setup, doctor, uninstall, rotation, and guard behavior platform-aware

Verification

• pnpm -r build
• pnpm -r typecheck
• pnpm -r test (1,120 passed; 3 skipped)
• docker compose config
• full Dockerfile.listener build with exact @openai/codex@0.146.0
• independent standards review: SHIP
• independent spec review: SHIP

Fixes #14