fix(fleet): every LLM root unit restarts on a voluntary exit; parity seam gates it

frank-zealot shipped Restart=on-failure while its two siblings shipped
always. exit 0 is a CLEAN stop to systemd: on-failure leaves the endpoint
dark and the unit GREEN until the next boot — and frank-zealot is the
compaction hub for all three endpoints, so its quiet death degrades every
conversation in the fleet.

tests/llm_units.bats gains the fleet parity seam (Restart=always,
RestartSec 1..20, WantedBy=multi-user.target across scripts/frank-*.service);
the per-unit seams drop their weaker Restart greps so the policy lives in
one place. Runbook unit line updated.

tests/frank_zealot_unit.bats

@@ -85,10 +85,12 @@ run_stage() {
     [ -f "$ENV_FILE" ]
 }
 
-@test "frank-zealot is boot-persistent, self-healing and unprivileged" {
-    grep -q '^WantedBy=multi-user.target$' "$UNIT"
-    grep -q '^Restart=' "$UNIT"
-    grep -q '^RestartSec=' "$UNIT"
+@test "frank-zealot runs unprivileged with the memlock budget and its env file" {
+    # Restart policy, RestartSec and WantedBy are the FLEET parity seam
+    # (tests/llm_units.bats). What is endpoint-specific: CUDA pins its
+    # staging buffers, so the memlock budget is load-bearing even though the
+    # weights are copied into VRAM, and the unit must name the serve script
+    # and the env file that sizes it.
     grep -q '^User=dank$' "$UNIT"
     grep -q '^LimitMEMLOCK=infinity$' "$UNIT"
     grep -q '^ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-zealot.sh$' "$UNIT"