Issue 35945 runtime proof

Environment: Linux x86_64, Node v26.12.1, systemd 255 (255.4-1ubuntu8.18).
Base: 97cfc07759fed2a67edef22de4370ed74ff40030
Head: e3815c14c9e77b862b43e24af85e745392f687f5

Both commits were independently installed with vp i and built with
vp run build:bundle in apps/server. The driver invokes each built CLI's
actual service install command, using a disposable Linux account with its
own real systemd user manager. No service-manager mocks or unit tests.

To rerun: create a temporary Linux user whose HOME is <root>/service-user,
start its user manager (loginctl enable-linger), ensure it can traverse both
checkouts, then run as root:
python3 reproduce.py --root <root> --base <base-checkout> --head <head-checkout> --user <temporary-user> --uid <temporary-uid>
Stop the temporary user's manager, disable lingering, and remove the account
and scratch files afterwards. Never run against a real user's service.

Each case pre-seeds a version 0.1.9 executable fixture and install-complete
sentinel. The fixture answers --version with t3 v0.1.9 and otherwise execs
sleep infinity. This exercises installation, unit parsing and manager startup,
not a full T3 server process. It avoids network release downloads and matches
the original reproduction's executable fixture. No application DB was seeded.

Cases: plain, T3 Data, 100%h, ${UNSET}, T3 "Data", it's, T3\Data,
and T3 followed by a newline followed by Data. Each case starts without an
installed unit; the driver stops/disables/removes only its isolated unit.

before.txt and after.txt contain captured real command output. Internal paths
are anonymized to /proof and /checkout. PNGs are actual GNOME Terminal screen
captures displaying excerpts of those transcripts plus the result matrix;
stack frames are omitted in screenshots only. Each PNG was checked for pixel
stability against a second capture 500 ms later and opened for inspection.
These are static command results, not a recording of interactive UI behavior.

Observed: controls install, verify and run the fixture on both sides. On base,
all four unsafe names write a unit which fails verification and is bad-setting.
On head, all four are rejected with a clear directory error before a unit is
written; the manager reports not-found. Both return CLI exit 1 for those cases,
but only the base leaves an invalid installed service.