Packaging only; this server already set EPERM and was never exposed.

Fleet seccomp posture (mecmcp#354): the shipped unit now carries
SystemCallErrorNumber=EPERM alongside the @privileged denylist, so a denied
syscall returns an error instead of raising SIGSYS and killing the process
mid-request. SystemCallLog was evaluated and deliberately not shipped: seccomp's
ERRNO action outranks LOG, so denying and logging the same set records nothing.
Measured, not assumed.