Initial commit: autonomous maintenance agent for semprini stack

systemd-deployed daemon that drives the semprini-core stack-support agent
headless via Claude Code, monitors health via Uptime Kuma, applies safe
upgrades, and escalates to the operator over Matrix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

semprini-maintainer.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=semprini-core autonomous stack maintenance agent
+Documentation=file:///home/paul/Dev/semprini-maintainer/README.md
+After=docker.service network-online.target
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=simple
+# Runs as the host user (must be in the 'docker' group). NOT root: Claude Code
+# refuses --permission-mode bypassPermissions when running as root.
+User=paul
+Group=paul
+SupplementaryGroups=docker
+WorkingDirectory=/home/paul/Dev/semprini-maintainer
+Environment=HOME=/home/paul
+Environment=PATH=/home/paul/.local/bin:/usr/local/bin:/usr/bin:/bin
+ExecStart=/usr/bin/python3 /home/paul/Dev/semprini-maintainer/maintainer.py --config /home/paul/Dev/semprini-maintainer/config.json
+Restart=always
+RestartSec=30
+# Give a long-running upgrade plenty of time before any stop is considered hung.
+TimeoutStopSec=120
+
+# Light hardening (kept permissive — the agent legitimately drives Docker).
+NoNewPrivileges=false
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=semprini-maintainer
+
+[Install]
+WantedBy=multi-user.target