runtime: add sourceos-shell systemd target and service graph scaffold

[mdheller]

Summary

Stacked on top of the current sourceos-shell Linux realization chain, this PR adds a first-class sourceos-shell.target scaffold and extends the contract-style test to assert the service graph grouping is present.

Added files

• linux/systemd/sourceos-shell.target
• docs/sourceos-shell-service-graph.md

Updated files

• modules/nixos/sourceos-shell/default.nix
• tests/sourceos-shell-module-contract.nix

What it does

• adds systemd.targets.sourceos-shell to the Nix module scaffold
• groups the current four service scaffolds under that target:
  • sourceos-shell
  • sourceos-router
  • sourceos-pdf-secure
  • sourceos-docd
• marks each scaffold service as partOf = [ "sourceos-shell.target" ]
• extends the contract test to verify the target scaffold and the grouping assumptions

Why

The previous Linux PRs added service scaffolds individually, but the runtime surface was still missing an explicit service-graph grouping. This PR turns the current set of shell-related services into a coherent Linux target scaffold while the real product/runtime repo is still pending.

Stack relationship

This PR is stacked on top of:

• source-os#26
• source-os#70
• source-os#71
• source-os#72

Follow-on

• replace placeholder ExecStart values with real runtime/package paths once SourceOS-Linux/sourceos-shell exists
• upgrade scaffold assertions into actual service-graph checks
• tie the launcher/search-provider config to the eventual runtime-owned implementation