Ship systemd unit and maintainer scripts in .deb

Parent: #123

The `.deb` (__L1__) installs a systemd service unit and uses Debian maintainer scripts to register it without leaving the operator to copy files around.

## Definition of done

- Unit installed at `/lib/systemd/system/fallout-agent.service` (system-level, not user).
- Unit `Type=simple` (or `notify` if the agent supports `sd_notify` — decide during implementation), `Restart=on-failure`, `RestartSec=10s`.
- Runs as a dedicated `fallout-agent` system user (created in `postinst` via `adduser --system`).
- `postinst` runs `systemctl daemon-reload` and `systemctl enable fallout-agent` (does NOT start — operator starts after config).
- `prerm` runs `systemctl stop fallout-agent` and `systemctl disable fallout-agent`.
- `postrm` purges `/etc/fallout-agent/` only on `purge`, not on `remove`.
- Reinstall over an existing install does NOT double-enable or wipe `/etc/fallout-agent/`.