fix(install): 刚装完的服务会失败，单元要说清楚而不是每 5 秒重启一次

我在真内核上把安装序列完整走了一遍（容器里补了 useradd/systemctl 的替身，其余全是真的），
暴露出一个只有真跑才看得见的缺陷：

装完 → `install` 启动服务 → 但那时**还没有配对的手机**，而守护进程**故意**拒绝空的设备列表
（一个什么都不能授权的 agent 不该坐在那里显得健康）。于是 `Restart=always` + `RestartSec=5`
变成每 5 秒重启一次，永远，journal 里刷同一行。实测：exit 1，"devices is empty, so no phone
could ever be authorised"。

配对发生在安装**之后**（运维在节点上跑 `--pair`，然后在手机上配对），所以这不是异常状态，
而是流程的必经一步。修法两条：

- 单元加 `StartLimitIntervalSec=300` / `StartLimitBurst=10`：十次之后 systemd 放弃，单元进入
  `failed`——一个运维看得见、能处理的状态，而不是无限重启。
- `install` 的结束语改成说清这一步：服务会退出并停住，下一步是 `--pair`，用
  `systemctl status` 看状态。此前它说"installed and running"，而那是假的。

同一轮演练确认了此前所有修复在真内核上成立：服务用户建了、配置与日志目录交给它了、配置对
该用户可读、单元来自二进制且内容一致、卸载按序拆干净（用户/目录/单元全无残留）。

Go 全包通过（新增一项守着"单元必须有启动上限，且 install 必须说出下一步"）。

systemd/msa-agent.service

@@ -11,6 +11,17 @@ Restart=always
 # Backing off on our own is not enough: a relay that is down for an hour should not be hammered by
 # every node in the fleet the moment it comes back.
 RestartSec=5
+# A freshly installed node has no paired devices, and the daemon refuses to run in that state on
+# purpose: an agent that could authorise nothing must not sit there looking healthy. But pairing happens
+# *after* install — the operator runs `--pair` on the node and then pairs the phone — so between those
+# two moments this unit would restart every five seconds, forever, filling the journal with the same
+# line. Measured on a real kernel: exit 1, "devices is empty, so no phone could ever be authorised".
+#
+# StartLimitIntervalSec/StartLimitBurst make systemd give up instead: ten attempts inside five minutes
+# and the unit enters `failed`, which is a state an operator can see and act on. The install command
+# prints the next step precisely so that state is expected rather than surprising.
+StartLimitIntervalSec=300
+StartLimitBurst=10
 TimeoutStopSec=20
 KillSignal=SIGTERM