fix: enroll 写出守护进程会拒绝的配置，install 写出与自身路径不符的单元

四处"校验在错误的层"的缺陷，都属于同一类：每个组件单独看都对，接缝错了。

1. `msa-agent enroll --relay http://relay.example` / `relay.example` /
   `https://relay.example/v1` 都会写出配置文件，install 报成功，守护进程在**下一次启动**才
   拒绝，日志里只有一行 "msa-agent exiting"。规则原本散在三处（config 只查非空、transport
   查真实规则、enroll 的注册客户端另有一份），现在收进 `internal/relayurl` 一份，三处都调它。
   `config.File.Validate` 因此也补上了 https/host/无路径/无 query 的检查。

2. `enroll` 不再自己手写字段检查，改为构造真正的 `config.File` 并调用真正的 `Validate`——
   一份"什么是可用配置"的定义，结构上无法再漂移。`config.Marshal` 让 enroll 与 Save 用同一个
   编码器。

3. `install --config /srv/msa/config.json` 会给该文件改属主、交给服务用户，然后写一个
   ExecStart 指向 `/etc/msa-agent/config.json` 的单元——服务起来找不到配置就退出，而它需要的
   文件就在别处、属主正确、从未被读。`enroll --audit /srv/audit/audit.log` 同理：单元的
   `ReadWritePaths` 只覆盖 `/var/log/msa-agent`，在 `ProtectSystem=strict` 下 agent 的
   `MkdirAll` 报 EROFS，进程启动即退出，报错既不提那个 flag 也不提那条指令。现在单元是模板，
   `RenderedUnit` 按实际布局渲染，`--print-unit` 打印的就是会被写入的那一份；默认布局渲染结果
   与仓库里被 review 过的文件逐字节相同，所以 vendored 副本的漂移检查仍然有意义。

测试：新增 `internal/relayurl`，`config`/`enroll`/`install` 各补回归测试。每条都做了变异验证
（把修复回退，对应测试必须失败）。

internal/install/service.go

@@ -14,10 +14,20 @@ package install
 
 import (
 	_ "embed"
+	"encoding/json"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
+)
+
+// The two literals in the embedded unit that have to follow the install's own paths. They are named
+// here rather than parsed out of the file so a unit edit that removes one is a visible failure in
+// RenderedUnit's tests rather than a silent no-op substitution.
+const (
+	defaultConfigPath    = "/etc/msa-agent/config.json"
+	defaultWritablePaths = "/var/log/msa-agent"
 )
 
 // The vendored unit. It is copied from agent/systemd/ by the Makefile, and
@@ -31,6 +41,72 @@ var embeddedUnit []byte
 // UnitFile returns the unit this binary installs, for tests and for `install --print-unit`.
 func UnitFile() []byte { return embeddedUnit }
 
+// RenderedUnit is the unit as it will actually be written for a given layout.
+//
+// The embedded file is a template, and two of its literals have to follow the paths the install was
+// given. Both were measured drifting:
+//
+//   - `install --config /srv/msa/config.json` chowned that file, gave it to the service user, and then
+//     wrote a unit whose ExecStart named `/etc/msa-agent/config.json` — a path that on that node holds
+//     nothing, so the service fails with "no such file or directory" while the config it needs sits
+//     elsewhere, correctly owned and never read.
+//   - `enroll --audit /srv/audit/audit.log` puts that path in the config, and the unit's
+//     `ReadWritePaths=/var/log/msa-agent` does not cover it. Under `ProtectSystem=strict` the agent's
+//     `os.MkdirAll` for the parent directory fails with EROFS and the daemon exits at startup, with a
+//     permission error that names neither the flag nor the directive.
+//
+// The default layout renders byte-for-byte the embedded file, which is what keeps the vendored copy
+// and the drift test meaningful: the template is still the thing that was reviewed.
+func RenderedUnit(paths Paths, writableDirs []string) []byte {
+	unit := string(embeddedUnit)
+	// Only substituted when it differs, so the common install produces exactly the reviewed file and a
+	// diff of `install --print-unit` against the repository copy stays empty.
+	if paths.ConfigPath != defaultConfigPath {
+		unit = strings.Replace(unit, "--config "+defaultConfigPath, "--config "+paths.ConfigPath, 1)
+	}
+	dirs := uniqueDirs(append([]string{paths.LogDir}, writableDirs...))
+	if len(dirs) > 0 && strings.Join(dirs, " ") != defaultWritablePaths {
+		unit = strings.Replace(unit, "ReadWritePaths="+defaultWritablePaths, "ReadWritePaths="+strings.Join(dirs, " "), 1)
+	}
+	return []byte(unit)
+}
+
+// uniqueDirs keeps the first occurrence of each path, in order, so a log directory that is also an
+// audit directory appears once and the rendering is stable.
+func uniqueDirs(dirs []string) []string {
+	seen := map[string]bool{}
+	out := make([]string, 0, len(dirs))
+	for _, dir := range dirs {
+		dir = filepath.Clean(dir)
+		if dir == "" || dir == "." || dir == "/" || seen[dir] {
+			continue
+		}
+		seen[dir] = true
+		out = append(out, dir)
+	}
+	return out
+}
+
+// auditDirOf reports the directory the config's audit log needs to be writable, or "" when the config
+// cannot be read.
+//
+// An unreadable config is not an error here: `install --dry-run` is run on nodes where `enroll` has not
+// happened yet, and the real run refuses a missing config a few lines above. What it must not do is
+// invent a path — a wrong ReadWritePaths entry is a sandbox hole, and a missing one is the EROFS above.
+func auditDirOf(configPath string) string {
+	raw, err := os.ReadFile(configPath)
+	if err != nil {
+		return ""
+	}
+	var parsed struct {
+		AuditPath string `json:"auditPath"`
+	}
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		return ""
+	}
+	return filepath.Dir(parsed.AuditPath)
+}
+
 // InstallOptions configures an install.
 type InstallOptions struct {
 	Paths Paths
@@ -114,12 +190,16 @@ func Install(opts InstallOptions) error {
 		}
 	}
 
-	// 4. The unit, from this binary.
+	// 4. The unit, from this binary. The audit log's directory comes from the config that `enroll` wrote,
+	//    because the unit's ReadWritePaths is the only thing that makes it writable under
+	//    ProtectSystem=strict — and a config pointing outside it is a daemon that exits at startup with
+	//    EROFS, naming neither the flag nor the directive.
 	if stepWith(opts.DryRun, opts.Log, "writing %s", paths.UnitPath) {
 		if err := os.MkdirAll(filepath.Dir(paths.UnitPath), 0o755); err != nil {
 			return fmt.Errorf("install: creating the unit directory: %w", err)
 		}
-		if err := os.WriteFile(paths.UnitPath, embeddedUnit, 0o644); err != nil {
+		unit := RenderedUnit(paths, []string{auditDirOf(paths.ConfigPath)})
+		if err := os.WriteFile(paths.UnitPath, unit, 0o644); err != nil {
 			return fmt.Errorf("install: writing the unit: %w", err)
 		}
 	}
@@ -171,8 +251,13 @@ func chownTo(path, user string, opts InstallOptions) error {
 	return nil
 }
 
-// PrintUnit writes the embedded unit to w, so an operator can read what will be installed before it is.
-func PrintUnit(w io.Writer) error {
-	_, err := w.Write(embeddedUnit)
+// PrintUnit writes the unit as it would be installed for a layout to w, so an operator can read what
+// will be installed before it is.
+//
+// It renders rather than dumping the embedded bytes, because the two are not the same thing once the
+// install has been given a non-default config path or an audit log outside the log directory — and the
+// command's whole promise is that what it prints is what gets written.
+func PrintUnit(w io.Writer, paths Paths) error {
+	_, err := w.Write(RenderedUnit(paths, []string{auditDirOf(paths.ConfigPath)}))
 	return err
 }

internal/install/unitrender_test.go

@@ -0,0 +1,158 @@
+package install
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"fun.chick/msa-agent/internal/config"
+)
+
+// The embedded unit is a template, and the install's own paths have to reach it.
+//
+// Two literals were measured drifting, and both fail on the node rather than here:
+//
+//  1. `install --config /srv/msa/config.json` chowned that file and gave it to the service user, then
+//     wrote a unit whose ExecStart named the default path. The service starts, cannot find its config,
+//     and exits — with the file it needs sitting elsewhere, correctly owned and never read.
+//  2. `enroll --audit /srv/audit/audit.log` writes that path into the config, and the unit's
+//     ReadWritePaths covered only /var/log/msa-agent. Under ProtectSystem=strict the agent's MkdirAll
+//     for the parent directory fails with EROFS and the daemon exits at startup, naming neither the
+//     flag nor the directive.
+//
+// The rendering is deliberately identity-preserving for the default layout: the file a reviewer read
+// is still byte-for-byte what a default install writes, so the vendored-copy drift test keeps its
+// meaning.
+func TestRenderedUnitFollowsTheLayoutItWasGiven(t *testing.T) {
+	// (a) The default layout renders exactly the embedded file.
+	if got := string(RenderedUnit(DefaultPaths(), nil)); got != string(UnitFile()) {
+		t.Fatal("the default layout does not render the reviewed unit file")
+	}
+
+	// (b) A config path elsewhere reaches ExecStart.
+	custom := DefaultPaths()
+	custom.ConfigPath = "/srv/msa/config.json"
+	unit := string(RenderedUnit(custom, nil))
+	if !strings.Contains(unit, "ExecStart=/opt/msa-agent/msa-agent --config /srv/msa/config.json") {
+		t.Fatalf("ExecStart does not name the config the install was given:\n%s", execLines(unit))
+	}
+	if strings.Contains(unit, defaultConfigPath) {
+		t.Fatalf("the default config path is still in the unit:\n%s", execLines(unit))
+	}
+
+	// (c) An audit log outside the log directory becomes writable, and the default entry stays.
+	unit = string(RenderedUnit(DefaultPaths(), []string{"/srv/audit"}))
+	if !strings.Contains(unit, "ReadWritePaths=/var/log/msa-agent /srv/audit") {
+		t.Fatalf("the audit directory is not writable:\n%s", readWriteLines(unit))
+	}
+	// (d) A duplicate — an audit log that already lives in the log directory — is collapsed, so the
+	//     rendered file does not accumulate the same path on every re-install.
+	unit = string(RenderedUnit(DefaultPaths(), []string{"/var/log/msa-agent", "/var/log/msa-agent/"}))
+	if !strings.Contains(unit, "ReadWritePaths=/var/log/msa-agent\n") {
+		t.Fatalf("a duplicate writable path was rendered:\n%s", readWriteLines(unit))
+	}
+}
+
+// The install reads the audit path out of the config `enroll` wrote, so the two agree without anyone
+// passing the flag twice. An unreadable config yields nothing rather than a guess: a wrong
+// ReadWritePaths entry is a sandbox hole, and a missing one is the EROFS above.
+func TestTheAuditDirectoryComesFromTheConfig(t *testing.T) {
+	directory := t.TempDir()
+	path := filepath.Join(directory, "config.json")
+	cfg := config.File{
+		NodeID: "nd_7f3a9c2e", RelayURL: "https://relay.example", AgentToken: "tok",
+		LocalPort: 3000, SignKey: "AAAA", KxKey: "AAAA",
+		AuditPath: "/srv/audit/audit.log", Devices: []config.Device{},
+	}
+	if err := config.Save(path, cfg); err != nil {
+		t.Fatal(err)
+	}
+	if got := auditDirOf(path); got != "/srv/audit" {
+		t.Fatalf("auditDirOf = %q, want /srv/audit", got)
+	}
+	if got := auditDirOf(filepath.Join(directory, "absent.json")); got != "" {
+		t.Fatalf("auditDirOf invented %q for a config that is not there", got)
+	}
+	if err := os.WriteFile(path, []byte("not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := auditDirOf(path); got != "" {
+		t.Fatalf("auditDirOf invented %q for an unparseable config", got)
+	}
+}
+
+// And the whole install writes the rendered unit, not the embedded bytes. This is the assertion that
+// would fail if the two ever came apart again.
+func TestInstallWritesAUnitForItsOwnPaths(t *testing.T) {
+	root := t.TempDir()
+	paths := Paths{
+		ServiceName: "msa-agent",
+		UnitPath:    filepath.Join(root, "etc/systemd/system/msa-agent.service"),
+		ConfigPath:  filepath.Join(root, "srv/msa/config.json"),
+		LogDir:      filepath.Join(root, "var/log/msa-agent"),
+		BinaryPath:  filepath.Join(root, "opt/msa-agent/msa-agent"),
+		User:        "msa-agent",
+	}
+	for _, path := range []string{paths.BinaryPath, paths.ConfigPath} {
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.WriteFile(paths.BinaryPath, []byte("binary"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cfg := config.File{
+		NodeID: "nd_7f3a9c2e", RelayURL: "https://relay.example", AgentToken: "tok",
+		LocalPort: 3000, SignKey: "AAAA", KxKey: "AAAA",
+		AuditPath: filepath.Join(root, "srv/audit/audit.log"), Devices: []config.Device{},
+	}
+	if err := config.Save(paths.ConfigPath, cfg); err != nil {
+		t.Fatal(err)
+	}
+
+	runner := &recorder{failOn: "getent"}
+	if err := Install(InstallOptions{Paths: paths, Runner: runner, Log: func(string, ...any) {}}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+	written, err := os.ReadFile(paths.UnitPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	unit := string(written)
+	if !strings.Contains(unit, "--config "+paths.ConfigPath) {
+		t.Fatalf("the installed unit does not name the config the install was given:\n%s", execLines(unit))
+	}
+	if !strings.Contains(unit, "ReadWritePaths="+paths.LogDir+" "+filepath.Join(root, "srv/audit")) {
+		t.Fatalf("the installed unit does not make the audit log writable:\n%s", readWriteLines(unit))
+	}
+}
+
+// PrintUnit is the operator's preview of the install, so it has to be the same rendering the install
+// writes. Dumping the embedded bytes would show a default-layout unit to someone installing with
+// --config, which is a preview of a different file.
+func TestPrintUnitShowsWhatTheInstallWouldWrite(t *testing.T) {
+	paths := DefaultPaths()
+	paths.ConfigPath = "/srv/msa/config.json"
+	var printed strings.Builder
+	if err := PrintUnit(&printed, paths); err != nil {
+		t.Fatal(err)
+	}
+	if printed.String() != string(RenderedUnit(paths, []string{auditDirOf(paths.ConfigPath)})) {
+		t.Fatal("--print-unit and the install would write different files")
+	}
+}
+
+func execLines(unit string) string { return linesStartingWith(unit, "ExecStart") }
+
+func readWriteLines(unit string) string { return linesStartingWith(unit, "ReadWritePaths") }
+
+func linesStartingWith(unit, prefix string) string {
+	var out []string
+	for _, line := range strings.Split(unit, "\n") {
+		if strings.HasPrefix(line, prefix) {
+			out = append(out, line)
+		}
+	}
+	return strings.Join(out, "\n")
+}