Phase 3+4: systemd generator, install, active, status

- systemd/generator.go: build .service file content from Unit
- systemd/manager.go: install/uninstall/enable/disable/status via systemctl
- cmd/install.go: write unit files, --dry-run flag, remove disabled units
- cmd/active.go: enable + start units in order
- cmd/status.go: summary table with name/runtime/user/enabled/installed/state

systemd/manager.go

@@ -0,0 +1,145 @@
+package systemd
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/warkanum/unitdore/config"
+)
+
+const systemUnitDir = "/etc/systemd/system"
+
+// UnitPath returns the filesystem path where the .service file should be written.
+func UnitPath(u config.Unit) (string, error) {
+	if u.User == "" {
+		return filepath.Join(systemUnitDir, ServiceName(u)), nil
+	}
+	// Rootless: write to the user's systemd config dir
+	home, err := userHomeDir(u.User)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".config", "systemd", "user", ServiceName(u)), nil
+}
+
+// Install writes the .service file for a unit and reloads systemd.
+func Install(u config.Unit) error {
+	content, err := Generate(u)
+	if err != nil {
+		return err
+	}
+
+	path, err := UnitPath(u)
+	if err != nil {
+		return err
+	}
+
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return fmt.Errorf("creating unit dir: %w", err)
+	}
+
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		return fmt.Errorf("writing unit file: %w", err)
+	}
+
+	return daemonReload(u.User)
+}
+
+// Uninstall removes the .service file for a unit and reloads systemd.
+func Uninstall(u config.Unit) error {
+	path, err := UnitPath(u)
+	if err != nil {
+		return err
+	}
+
+	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("removing unit file: %w", err)
+	}
+
+	return daemonReload(u.User)
+}
+
+// Enable enables and starts a unit.
+func Enable(u config.Unit) error {
+	return systemctl(u.User, "enable", "--now", ServiceName(u))
+}
+
+// Disable disables and stops a unit.
+func Disable(u config.Unit) error {
+	return systemctl(u.User, "disable", "--now", ServiceName(u))
+}
+
+// Status returns the ActiveState of a unit ("active", "inactive", "failed", "unknown").
+func Status(u config.Unit) string {
+	args := []string{"show", "-p", "ActiveState", "--value", ServiceName(u)}
+	var out []byte
+	var err error
+
+	if u.User == "" {
+		out, err = exec.Command("systemctl", args...).Output()
+	} else {
+		out, err = runAsUser(u.User, "systemctl", append([]string{"--user"}, args...)...)
+	}
+	if err != nil {
+		return "unknown"
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// IsInstalled returns true if the unit file exists on disk.
+func IsInstalled(u config.Unit) bool {
+	path, err := UnitPath(u)
+	if err != nil {
+		return false
+	}
+	_, err = os.Stat(path)
+	return err == nil
+}
+
+// --- helpers ---
+
+func daemonReload(user string) error {
+	if user == "" {
+		return systemctl("", "daemon-reload")
+	}
+	return systemctl(user, "daemon-reload")
+}
+
+func systemctl(user string, args ...string) error {
+	if user == "" {
+		cmd := exec.Command("systemctl", args...)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		return cmd.Run()
+	}
+	return runAsUserCmd(user, "systemctl", append([]string{"--user"}, args...)...)
+}
+
+func runAsUser(user string, bin string, args ...string) ([]byte, error) {
+	full := append([]string{"-u", user, "--", bin}, args...)
+	return exec.Command("runuser", full...).Output()
+}
+
+func runAsUserCmd(user string, bin string, args ...string) error {
+	full := append([]string{"-u", user, "--", bin}, args...)
+	cmd := exec.Command("runuser", full...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+func userHomeDir(user string) (string, error) {
+	out, err := exec.Command("getent", "passwd", user).Output()
+	if err != nil {
+		return "", fmt.Errorf("looking up user %s: %w", user, err)
+	}
+	// passwd format: name:pass:uid:gid:gecos:home:shell
+	parts := strings.Split(strings.TrimSpace(string(out)), ":")
+	if len(parts) < 6 {
+		return "", fmt.Errorf("unexpected passwd entry for %s", user)
+	}
+	return parts[5], nil
+}