[v1.x] Harden Asuswrt-Merlin service lifecycle

[maghuro]

Important

Local staging/review draft in the fork only. Upstream contribution guidelines require an issue before any PR.

Targeted at the maintained v1.x router-support line. This is the v1.x port of #3.

Summary

• atomically publish and conservatively migrate ctrld.startup;
• preserve installed argument boundaries with POSIX-safe quoting;
• migrate exact v1.5.x startup scripts from the newly launched binary after self-upgrade;
• keep exact legacy startup usable if migration publication fails;
• validate PID ownership and kill the exact validated PID;
• wait briefly for the background child to exec before declaring startup failure;
• serialize Merlin lifecycle mutations and the actual CLI restart/upgrade stop-cleanup-start transaction with one cross-process lock;
• preserve the historical non-Merlin restart paths;
• publish new shared hook stubs with no-clobber semantics and preserve unrelated shared-hook content/modes;
• remove both current and legacy hook references on uninstall;
• validate dnsmasq PID ownership before the diskmon service-event signal;
• include the full Harden Asuswrt-Merlin service install and lifecycle #3 migration/race/lifecycle regression suite.

Port parity

The Merlin service implementation, Linux/portable startup migration helpers, lifecycle lock and tests are byte-for-byte aligned with current #3. The v1.x CLI keeps its own newer maintenance-line behavior (including its existing upgrade rollback improvements) while adding the same Merlin RestartWith transaction and newly-launched-binary migration hook.

Scope

Service lifecycle only. dnsmasq/SDN integration is staged separately in #6/#7.

[maghuro]

v1.x parity update on current head 05ea81e6ea:

• Merlin service implementation, startup migration helpers, lifecycle lock and regression tests are byte-for-byte aligned with current Harden Asuswrt-Merlin service install and lifecycle #3;
• added the missing v1.x CLI integration so the real restart and upgrade flows use the Merlin-only RestartWith transaction;
• added newly-launched-binary startup migration in ctrld run;
• preserved v1.x-specific maintenance-line behavior, including the existing upgrade rollback path.

Current-head CI passes Ubuntu, macOS and Windows, including go test -race ./... and Staticcheck.