Feature/skill self debug and systemd service

[keithy]

📝 Description
This PR introduces essential stability and observability features for PicoClaw.
It adds a Self-Debug Skill to allow the agent to diagnose its own execution failures from logs
and a Systemd Service installer to ensure the agent runs as a persistent, background daemon.

🗣️ Type of Change
[ ] 🐞 Bug fix (non-breaking change which fixes an issue)
[x] ✨ New feature (non-breaking change which adds functionality)
[ ] 📖 Documentation update
[x] ⚡ Code refactoring (improved service management)

🤖 AI Code Generation
[x] 👨‍💻 Mostly Human-written (Human lead)

🔗 Related Issue

• daemon feature #483
• feat(gateway): add daemon controls for background operation #810

📚 Technical Context
Reference URL: https://github.com/keithy/picoclaw/tree/feature/skill_self-debug_and_systemd_service

🧪 Test Environment
Hardware: Rock64 (ARM64)
OS: Debian/Ubuntu (Linux) armbian, mise
Channels: CLI / Local Daemon

☑️ Checklist
[x] My code/docs follow the style of this project.
[x] I have performed a self-review of my own changes.
[x] I have updated the documentation (added systemd instructions).

[keithy]

Note this is supplied as a self-contained skill, so that other options can be included easily.

[keithy]

Advanced use-cases

Although picoclaw has built in support for multiple agents, this scheme provides the flexibility for
parallel deployments with entirely different configurations e.g.

• Fixer - a second stable instance whose role is to be available to debug/monitor/fix the first.
• Blue/Green Stable/Canary pairings.
• Picoclaw farm

Personal note:
I use the fixer pattern, with the systemd.service unit installed, the default behaviour is to start and stop the service when the user logs in/out. The fixer runs under a separate user account and has sudo access to fix anything, so is under close supervison. This gives the ai a unique, in-situ position to debug and operate at a system level. For example, it helped me to compile and deploy the zfs kernel module into the rock64 on armbian.

[nikolasdehor]

Interesting and useful skill concept — self-debugging is a powerful capability. Several issues: (1) Shell injection risk: SKILL.md tools pass PICOCLAW_SERVICE_NAME directly into exec commands. If the service name contains shell metacharacters, this could be exploited. Consider validating/sanitizing the service name. (2) macOS script parity: The launchd script lacks error handling compared to systemd — uses 'which' instead of 'command -v', no check for picoclaw binary existence, missing trailing newline. (3) Log location on macOS: /tmp/service_name.log is world-readable and cleared on reboot. Consider ~/Library/Logs/. (4) SKILL.md quoting: exec picoclaw --config PICOCLAW_CONFIG status has nested double quotes that would break in shell. (5) Scope question: Is workspace/skills/ the correct location for bundled skills?

[keithy]

I am tidying this PR, watch this space.

[keithy]

Are you now explicitly blocking systemctl and journalctl ? The whole reason I am using picoclaw is to manage my infrastructure.