feat: podman-compose stack units and root/user execution scopes

- syncup: podman first, docker only as fallback (podman wins on name clash;
  existing docker units found in podman switch to podman)
- syncup: group podman-compose containers into one `kind: stack` unit per
  project (project, working_dir, compose_files, compose_bin from labels);
  disable existing member units ("part of stack <project>")
- generator: compose mode (podman-compose up/stop, WorkingDirectory) with
  pod start/stop fallback when compose binary/dir/files are missing
- reconcile: stacks disabled with "stack not found" when neither compose
  files nor pod exist
- root: scan root + rootless users listed in `users:` (podman only)
- non-root: config ~/.config/unitdore/units.yaml, own user units only
- sysuser package: runuser with XDG_RUNTIME_DIR/DBUS env, home/linger lookup
- install: warn when linger is not enabled for user units
- testdata/stack: podman-compose test stack and captured podman ps fixture
- docs: README, generated-units, man page, AGENTS, PLAN

systemd/manager.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/warkanum/unitdore/config"
+	"github.com/warkanum/unitdore/sysuser"
 )
 
 const systemUnitDir = "/etc/systemd/system"
@@ -19,7 +20,7 @@ func UnitPath(u config.Unit, prefix, suffix string) (string, error) {
 		return filepath.Join(systemUnitDir, svcName), nil
 	}
 	// Rootless: write to the user's systemd config dir
-	home, err := userHomeDir(u.User)
+	home, err := sysuser.HomeDir(u.User)
 	if err != nil {
 		return "", err
 	}
@@ -130,27 +131,19 @@ func systemctl(user string, args ...string) error {
 }
 
 func runAsUser(user string, bin string, args ...string) ([]byte, error) {
-	full := append([]string{"-u", user, "--", bin}, args...)
-	return exec.Command("runuser", full...).Output()
+	cmd, err := sysuser.Command(user, bin, args...)
+	if err != nil {
+		return nil, err
+	}
+	return cmd.Output()
 }
 
 func runAsUserCmd(user string, bin string, args ...string) error {
-	full := append([]string{"-u", user, "--", bin}, args...)
-	cmd := exec.Command("runuser", full...)
+	cmd, err := sysuser.Command(user, bin, args...)
+	if err != nil {
+		return err
+	}
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	return cmd.Run()
 }
-
-func userHomeDir(user string) (string, error) {
-	out, err := exec.Command("getent", "passwd", user).Output()
-	if err != nil {
-		return "", fmt.Errorf("looking up user %s: %w", user, err)
-	}
-	// passwd format: name:pass:uid:gid:gecos:home:shell
-	parts := strings.Split(strings.TrimSpace(string(out)), ":")
-	if len(parts) < 6 {
-		return "", fmt.Errorf("unexpected passwd entry for %s", user)
-	}
-	return parts[5], nil
-}