fix(maestro): installer unit sets KillMode=process so restarts keep sessions (NAP-330)

The generated `maestro.service` used systemd's default
`KillMode=control-group`, so `systemctl restart` (any update/auto-update)
SIGKILLed the daemon's whole cgroup — including the tmux server and every
`maestro-<uuid>` session. recover() then found nothing, silently destroying
all live sessions and their processes on every restart.

Emit `KillMode=process` in the daemon unit so only the daemon's MainPID is
signalled; the tmux server survives and recover() re-adopts the sessions on
the next start. (The web unit spawns no tmux, so it's left unchanged.)

Tests assert the daemon unit carries KillMode=process and the web unit does
not. INSTALL.md notes that updating keeps sessions, and that units written
before this default need a refresh.

Verified live on a host: with KillMode=process a restart leaves the session's
PID unchanged (recovered=1); without it, recovered=0 and the process is gone.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/INSTALL.md

@@ -20,7 +20,10 @@ wizard, and cleans up — only the unified `maestro` binary ends up persisted in
 existing `[daemon]` section in `~/.config/maestro/config.toml` and an
 existing systemd unit, skips the configure prompt, refreshes the unit, and
 runs `systemctl --user restart maestro` instead of `start`. No `--update`
-flag needed.
+flag needed. **The restart keeps your sessions:** the unit sets
+`KillMode=process`, so systemd signals only the daemon — the tmux server (and
+every session) survives, and the new daemon re-adopts them on start. A unit
+written before this default lacks the line; re-run `./install.sh` to refresh it.
 
 Inside the script, `cargo install --git https://git.naps.pt/naps62/maestro …`
 uses your already-configured git credentials for this host (HTTPS helper or