Privileged PTY launch boundary

Authenticate the connection lifetime with a pidfd and reassert identity immediately before StartTransientUnit: verify exact UID/GID, active systemd MainPID, InvocationID, and service cgroup, keeping the CLOEXEC pidfd open through launch. Peer credentials alone do not authenticate the current connection holder. Generate supervisor-owned names matching opencode-pty-[0-9a-f]{32}.service. Accept no client environment or systemd property names; the launcher must clearenv() and set only approved variables. Use go-systemd v22.5.0 on Go 1.22 and direct D-Bus Unix-FD properties, passing one duplex PTY stream and the approved cwd descriptor; avoid systemd-run and hand-written D-Bus transport.