fix(service_manager): systemd unit Restart=on-failure → always

After `gateway_auto_update::tick` completes a binary swap it calls
`std::process::exit(0)` to hand off to the supervisor (per the doc at
gateway_auto_update.rs:18 — "the OS supervisor … systemd Restart=always
— relaunches us on the new binary"). The systemd unit template shipped
`Restart=on-failure`, which systemd treats as success-and-stop for an
exit-code-0 process. So after every gateway self-update on Linux,
systemd correctly noticed the process exited cleanly and refused to
restart it — silently turning auto-update into "the gateway uninstalls
itself".

macOS launchd defaults to `KeepAlive=true` so the symmetric bug was
Linux-only. 0.1.25 was published briefly with this defect and pulled
once it was caught; this rolls forward into 0.1.26.

Added a unit test asserting the rendered unit contains `Restart=always`
and does not contain `Restart=on-failure`, so this can't silently
regress in a future template tweak.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: shaoweihu

Cargo.lock

@@ -14,7 +14,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.1.25"
+version = "0.1.26"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/Pyiner/garyx"

Cargo.toml

@@ -271,7 +271,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=/bin/sh -c 'exec \"$(getent passwd %u | cut -d: -f7)\" -lic \"exec {binary_arg} gateway run --host {host} --port {port}\"'
-Restart=on-failure
+Restart=always
 RestartSec=5
 TimeoutStopSec=10
 {workspace_line}EnvironmentFile=-{env_file}

garyx/src/service_manager/systemd.rs

@@ -20,6 +20,14 @@ fn render_unit_file_contains_exec_start_and_logs() {
     assert!(unit.contains("TimeoutStopSec=10"));
     assert!(unit.contains("WantedBy=default.target"));
     assert!(!unit.contains("GARYX_WORKSPACE_ROOT"));
+
+    // `gateway_auto_update::tick` ends every successful binary swap with
+    // `std::process::exit(0)` and relies on the supervisor relaunching the
+    // process on the new binary. systemd treats exit-code-0 as success, so
+    // `Restart=on-failure` would silently kill the service after self-update.
+    // The unit MUST use `Restart=always` to make exit-code-0 trigger a restart.
+    assert!(unit.contains("Restart=always"));
+    assert!(!unit.contains("Restart=on-failure"));
 }
 
 #[test]