feat: add opt-in headless services

[domcyrus]

Summary

• add secure --output-file support and Windows SCM lifecycle integration
• ship inactive systemd, launchd, Windows, FreeBSD, and Compose service packaging
• add package and CI validation plus service guides in all supported languages

Validation

• cargo test --locked --workspace --all-targets --all-features
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
• scripts/check-service-packaging.sh
• rebuilt DEB and RPM packages

[domcyrus]

Superseded by #601, stacked on #602. Useful Linux service documentation, hardening, and packaging checks were consolidated there. All checks pass, including real systemd shutdown and package inspection. Windows SCM, launchd, and FreeBSD services remain deferred.