mbproxy: cross-platform support — Linux/systemd alongside Windows

Make the service build, run, and install on Linux as a first-class
target while keeping the Windows Service + Event Log behaviour intact.

- Build: drop the hardcoded win-x64 RID — single-file publish now works
  for any RID. publish.ps1 gains -Rid; new publish.sh for Linux hosts.
- Diagnostics: DiagnosticSinkSelector picks the Error+ sink per host —
  Windows Event Log under the SCM, local syslog under systemd
  (Serilog.Sinks.SyslogMessages), none for interactive runs. The
  EventLog truncation helper is extracted so it is testable cross-OS.
- Host: Program.cs registers AddSystemd() alongside AddWindowsService().
- Config: a RID-conditioned appsettings template ships Windows or Unix
  paths; both templates are schema-validated by a test.
- Install: systemd unit (Type=exec) plus install.sh / uninstall.sh.
  Also fixes two cross-platform bugs found while testing: install.ps1
  and uninstall.ps1 used New-EventLog / Remove-EventLog (absent in
  PowerShell 7), and the E2E sim launcher hardcoded Windows venv paths.
- Docs updated across README, CLAUDE.md, and docs/ for dual-platform.

413 tests pass on Windows; 374 (all non-simulator) on Linux.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mbproxy/install/mbproxy.service

@@ -0,0 +1,45 @@
+# systemd unit for mbproxy — the Modbus TCP BCD proxy.
+#
+# Installed to /etc/systemd/system/mbproxy.service by install.sh.
+# The Linux counterpart of the Windows Service registered by install.ps1.
+#
+# Type=exec (not Type=notify): mbproxy is a leaf service that nothing orders
+# against, so systemd's readiness signal is unnecessary. Type=exec marks the
+# unit active once the binary is exec'd; graceful stop still works because the
+# .NET generic host handles SIGTERM directly (drains in-flight requests within
+# Connection.GracefulShutdownTimeoutMs).
+
+[Unit]
+Description=mbproxy — Modbus TCP BCD proxy
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=exec
+ExecStart=/opt/mbproxy/Mbproxy
+WorkingDirectory=/etc/mbproxy
+User=mbproxy
+Group=mbproxy
+
+# Restart on crash, but not on a clean SIGTERM stop.
+Restart=on-failure
+RestartSec=5
+# Keep above Connection.GracefulShutdownTimeoutMs (default 10 s) so the drain
+# completes before systemd escalates to SIGKILL.
+TimeoutStopSec=30
+
+# Self-contained single-file publish: pin native-library extraction to a stable,
+# writable directory (install.sh creates it and grants the mbproxy account access).
+Environment=DOTNET_BUNDLE_EXTRACT_BASE_DIR=/var/cache/mbproxy
+
+# Hardening. The service only needs to write its log and bundle-cache directories.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadWritePaths=/var/log/mbproxy /var/cache/mbproxy
+# If any configured ListenPort is below 1024, also add:
+#   AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target