chore: the systemd unit runs Steward, not FabledNetMon

systemd/fablednetmon.service still carried the project's first name in
its user, paths, command and config location, so it couldn't start
Steward as written. It is now systemd/steward.service: user steward,
/opt/steward, `steward --config /etc/steward/config.yaml`, with a note
that /data must be writable (secret.key, safety backups) and why
Restart=on-failure brings Steward back after a web UI restore (exit 3).

The legacy-name guard now reads service units too, and forbids
"netmon" beside "scryer" and "roundtable". The 2026-04 rebrand plan and
spec under docs/superpowers keep the old names: they record the rename.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_no_legacy_names.py

@@ -1,10 +1,11 @@
 """Regression guard: shipped code must not reference old project names.
 
-The FabledScryer -> Roundtable -> Steward renames repeatedly left stale package
-imports behind in the (then separate) plugins (e.g. `from fabledscryer.models...`),
-silently breaking every non-host_agent plugin. Now that plugins are folded in-tree
-and version with core, this test fails loudly if either legacy name reappears in
-the shipped Python / templates / plugin manifests.
+The FabledNetMon -> FabledScryer -> Roundtable -> Steward renames repeatedly left
+stale names behind: package imports in the (then separate) plugins (e.g. `from
+fabledscryer.models...`), silently breaking every non-host_agent plugin, and a
+systemd unit still running `fablednetmon` as user `fablednetmon`. This test fails
+loudly if a legacy name reappears in the shipped Python, templates, plugin
+manifests or service units.
 """
 from __future__ import annotations
 
@@ -13,9 +14,9 @@ from pathlib import Path
 import pytest
 
 _ROOT = Path(__file__).resolve().parent.parent
-_TREES = [_ROOT / "steward", _ROOT / "plugins"]
-_EXTENSIONS = {".py", ".yaml", ".yml", ".html", ".j2"}
-_FORBIDDEN = ("scryer", "roundtable")  # case-insensitive; old project names
+_TREES = [_ROOT / "steward", _ROOT / "plugins", _ROOT / "systemd"]
+_EXTENSIONS = {".py", ".yaml", ".yml", ".html", ".j2", ".service"}
+_FORBIDDEN = ("scryer", "roundtable", "netmon")  # case-insensitive; old project names
 
 
 def _shipped_files():
@@ -25,6 +26,10 @@ def _shipped_files():
                 yield path
 
 
+def test_the_guard_reads_the_service_units():
+    assert any(p.suffix == ".service" for p in _shipped_files())
+
+
 @pytest.mark.parametrize("name", _FORBIDDEN)
 def test_no_legacy_project_name(name):
     offenders = [