systemd

Use a dedicated service user, Restart=on-failure, and a preflight checksum check on evm-mainnet.toml before start.

Keep:

• ReadWritePaths=/var/lib/nvc /var/log/nvc
• no private keys in the unit file
• RPC on 127.0.0.1:9332

See config/nvc-node.service in the source tree for the production unit shape.