Add verae-keep: host supervisor with watch+guard on NS1.

Restarts crashed units unless the admin console paused or stopped
them. Fleet writes per-instance intent.json. Tested on 138:
crash-restart, pause-hold, watch respawn of keep.

packages/verae-keep/test/intent.test.js

@@ -0,0 +1,33 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { emptyStore, record, pickIntent, writeUnitFile, readUnitFile, fromFleetService } from '../src/intent.js';
+
+test('record and pick newest intent', () => {
+  const s = emptyStore();
+  record(s, 'a', 'run', 'keep');
+  const older = { state: 'stop', source: 'file', updatedAt: '2020-01-01T00:00:00Z' };
+  const picked = pickIntent(s.units.a, older);
+  assert.equal(picked.state, 'run');
+  assert.equal(picked.source, 'keep');
+});
+
+test('unit file round-trip', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'keep-intent-'));
+  const file = path.join(dir, 'intent.json');
+  writeUnitFile(file, 'x', 'pause', 'admin');
+  const got = readUnitFile(file);
+  assert.equal(got.state, 'pause');
+  assert.equal(got.source, 'admin');
+});
+
+test('fleet enabled false is stop; paused instance is pause', () => {
+  assert.equal(fromFleetService({ enabled: false, instances: [] }, 't-0').state, 'stop');
+  assert.equal(
+    fromFleetService({ enabled: true, instances: [{ id: 't-0', paused: true }] }, 't-0').state,
+    'pause',
+  );
+  assert.equal(fromFleetService({ enabled: true, instances: [{ id: 't-0', paused: false }] }, 't-0').state, 'run');
+});