Add verae-keep: host supervisor with watch+guard on NS1.

Restarts crashed units unless the admin console paused or stopped
them. Fleet writes per-instance intent.json. Tested on 138:
crash-restart, pause-hold, watch respawn of keep.

packages/verae-keep/scripts/guard.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Last-resort backup: if watch (and therefore keep) dies, start it again.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+STATE="${KEEP_STATE:-$ROOT/data}"
+mkdir -p "$STATE"
+cd "$ROOT"
+export KEEP_UNITS="${KEEP_UNITS:-$ROOT/units.json}"
+export KEEP_STATE="$STATE"
+while true; do
+  echo "{\"t\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"event\":\"guard-start-watch\"}" >>"$STATE/guard.log"
+  node src/watch.js >>"$STATE/guard.out" 2>&1 || true
+  sleep 2
+done