Fixes the systemd unit: cwsd now runs as a dedicated, unprivileged system user (DynamicUser=yes, added to dialout+audio) reading /etc/cwsd/cwsdrc — no hardcoded account. Adds a -c/--config flag.
Portable static tarballs (x86-64/arm64, glibc + fully-static musl) are rebuilt and attached by CI with the corrected unit.