MainPID user-writable restart

Trap: authenticating the active systemd MainPID and hashing the three Go helpers looks runtime-bound, but Restart=always can relaunch a same-UID-replaced SEA or auto-loaded plugin that still passes MainPID authentication. Fix: install the exact SEA and loaded plugins in root-controlled immutable locations and bind their hashes—plus incorporated Core host source—to the readiness manifest before startup.