fix(#894): detect systemd-supervised sync engines

[joelmitz]

Summary

Fixes the duplicate-engine failure described in #894.

• Add a shared systemd user-unit probe based on LoadState, ActiveState, SubState, and MainPID.
• Reuse the probe from status and sync start.
• Treat verified active units as running, active units with unverified identity as unknown, and inactive/failed units as systemd-owned.
• Keep the existing pidfile path for teams without a systemd unit.
• Keep stop/reap and internal pidfile lifecycle operations scoped to pidfile-owned engines.
• Add fake-systemctl characterization coverage for verified, duplicate-prevention, unknown-identity, and inactive states.

Design

The probe validates the MainPID liveness and the exact remote-sync engine/team argv before calling an active unit running. If the unit is active but identity cannot be verified, sync start fails closed instead of creating an unmanaged duplicate. If the unit is inactive or failed, sync start refuses and directs the operator to the systemd user unit.

A hook-only change would miss direct sync start callers. Writing a pidfile from the service would reintroduce pidfile ownership and TOCTOU risks. Therefore the ownership probe is shared at the remote CLI boundary.

Related: #894