feat(deploy): conflict-free 'git pull' update flow (D001/D004/D005)

- deploy.sh: clean-tree guard + git fetch && git pull --ff-only + optional
  dep reinstall + app.db --migrate + restart.
- restart-service.sh: supervisor-agnostic restart (systemd or fallback), waits
  for an in-flight scan.
- check_runtime_git.sh: proves no scan writes git-tracked runtime data.
- ids.service: systemd unit template.
- tests/test_deployment.py: stdlib unittest invariant tests for the deployment
  runtime-isolation guarantee.

deploy/ids.service

@@ -0,0 +1,41 @@
+# systemd unit template (D005) — intrusion-detection web UI.
+#
+# Install:
+#   - Replace /path/to/intrusion-detection and the User/Group.
+#   - Copy to /etc/systemd/system/ids.service
+#   - sudo systemctl daemon-reload && sudo systemctl enable --now ids
+#
+# The app binds to 127.0.0.1:<WEB_PORT>; it must NOT be exposed to the LAN.
+#
+# Restart policy: automatically restart on crash. `deploy/deploy.sh` restarts
+# this unit after a successful `git pull`. Scans run in a background thread, so
+# one (serialized) scan at a time; deploy waits for the worker to be idle
+# (see restart-service.sh) before restarting.
+
+[Unit]
+Description=Intrusion Detection web UI + IDS scanner
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Run as an unprivileged user; the app only needs read access to the log dirs
+# it consumes (COPYPARTY_LOG_PATH / NPM_LOG_PATH) and write access to its own
+# data/ + reports/ + ids.db.
+User=ids
+Group=ids
+WorkingDirectory=/path/to/intrusion-detection
+EnvironmentFile=-/etc/ids.env
+ExecStart=/path/to/intrusion-detection/.venv/bin/python /path/to/intrusion-detection/app.py
+Restart=on-failure
+RestartSec=5
+
+# Hardening
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=no
+ReadWritePaths=/path/to/intrusion-detection/data /path/to/intrusion-detection/reports /var/lib/ids
+
+[Install]
+WantedBy=multi-user.target