Add verae-keep: host supervisor with watch+guard on NS1.

Restarts crashed units unless the admin console paused or stopped
them. Fleet writes per-instance intent.json. Tested on 138:
crash-restart, pause-hold, watch respawn of keep.

packages/verae-keep/systemd/verae-keep-guard.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Verae keep-alive guard (restarts watch + keep)
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=%h/verae-keep
+Environment=KEEP_UNITS=%h/verae-keep/units.ns1.json
+Environment=KEEP_STATE=%h/verae-keep/data
+ExecStart=/usr/bin/bash %h/verae-keep/scripts/guard.sh
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=default.target