fix(fleet): every LLM root unit restarts on a voluntary exit; parity seam gates it

frank-zealot shipped Restart=on-failure while its two siblings shipped
always. exit 0 is a CLEAN stop to systemd: on-failure leaves the endpoint
dark and the unit GREEN until the next boot — and frank-zealot is the
compaction hub for all three endpoints, so its quiet death degrades every
conversation in the fleet.

tests/llm_units.bats gains the fleet parity seam (Restart=always,
RestartSec 1..20, WantedBy=multi-user.target across scripts/frank-*.service);
the per-unit seams drop their weaker Restart greps so the policy lives in
one place. Runbook unit line updated.

tests/frank_dragoon_unit.bats

@@ -346,8 +346,9 @@ $(cat "$TEST_TMP/serve.log")"
 }
 
 @test "the deployed unit keeps the fleet's restart and boot-persistence shape" {
-    grep -qE '^Restart=(always|on-failure)$' "$UNIT"
-    grep -qE '^WantedBy=' "$UNIT"
+    # Restart=always and the WantedBy value are the FLEET parity seam
+    # (tests/llm_units.bats); what is endpoint-specific is which script the
+    # unit runs, under whom, and what a stop must reap.
     grep -qE '^ExecStart=.*/serve-frank-dragoon\.sh$' "$UNIT"
     grep -qE '^User=dank$' "$UNIT"
     grep -qE '^LimitMEMLOCK=infinity$' "$UNIT"