runtime: add sourceos-docd Linux service scaffold

[mdheller]

Summary

Stacked on top of the sourceos-shell Linux bootstrap and test/bridge PRs, this PR adds the sourceos-docd Linux service scaffold and extends the existing contract-style test to cover it.

Added files

• linux/systemd/sourceos-docd.service

Updated files

• modules/nixos/sourceos-shell/default.nix
• tests/sourceos-shell-module-contract.nix
• docs/sourceos-shell-integration.md

Why

The shell lane already includes service scaffolds for shell, router, and pdf-secure. The derive lane (docd) is part of the same runtime surface and should be represented in the Linux realization so the service graph is complete.

Changes

• adds systemd.services.sourceos-docd to the sourceos.shell module scaffold
• adds a systemd unit file scaffold under linux/systemd/
• extends the sourceos-shell module contract test to assert the docd scaffold exists
• updates the integration note to mention derive-service runtime integration

Stack relationship

This PR is stacked on top of:

• source-os#26
• source-os#70

Follow-on

• replace placeholder ExecStart with real package paths once SourceOS-Linux/sourceos-shell exists
• extend service graph checks beyond file existence
• bind docd into the eventual shell package/module output

[mdheller]

Stack note:

This PR sits on top of the current sourceos-shell Linux realization chain:

• base: runtime: bootstrap sourceos-shell Linux module, desktop entry, and service scaffolds #26 — module/profile/desktop/service scaffolds
• then: runtime: add sourceos-shell contract test and launcher bridge note #70 — contract-style test scaffold + launcher bridge note
• this PR: runtime: add sourceos-docd Linux service scaffold #71 — adds the sourceos-docd service scaffold and extends the shell module contract test

Main blocker remaining: the actual SourceOS-Linux/sourceos-shell product/runtime repo does not yet exist, so these Linux units still point at placeholder runtime paths. Once that repo exists, the next Linux PR should swap placeholders for real package/service paths and upgrade the checks from file-existence assertions to service-graph assertions.