feat(setup): per-checkout service name and docker image tag

Two NanoClaw installs on the same host used to fight over the shared `com.nanoclaw` launchd label / `nanoclaw.service` systemd unit and the `nanoclaw-agent:latest` docker tag — the second install silently rewrote the service pointer and rebuilt the image out from under the first. Introduces a deterministic per-checkout slug (sha1(projectRoot)[:8]) and namespaces everything off it:

- Service: `com.nanoclaw-v2-<slug>` / `nanoclaw-v2-<slug>.service`
- Image:   `nanoclaw-agent-v2-<slug>:latest` (base), `nanoclaw-agent-v2-<slug>:<agentGroupId>` (per-group)

New shared helpers: src/install-slug.ts (host) + setup/lib/install-slug.sh (bash). Both compute the same slug so verify/probe/add-*.sh/build.sh/container-runner all agree. Any v1 `com.nanoclaw` service left on the host stays untouched and can coexist.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/channels/whatsapp.ts

@@ -33,6 +33,7 @@ import * as p from '@clack/prompts';
 import k from 'kleur';
 
 import * as setupLog from '../logs.js';
+import { getLaunchdLabel, getSystemdUnit } from '../../src/install-slug.js';
 import {
   type Block,
   type StepResult,
@@ -358,17 +359,18 @@ async function restartService(): Promise<void> {
     if (platform === 'darwin') {
       spawnSync(
         'launchctl',
-        ['kickstart', '-k', `gui/${process.getuid?.() ?? 501}/com.nanoclaw`],
+        ['kickstart', '-k', `gui/${process.getuid?.() ?? 501}/${getLaunchdLabel()}`],
         { stdio: 'ignore' },
       );
     } else if (platform === 'linux') {
+      const unit = getSystemdUnit();
       const user = spawnSync(
         'systemctl',
-        ['--user', 'restart', 'nanoclaw'],
+        ['--user', 'restart', unit],
         { stdio: 'ignore' },
       );
       if (user.status !== 0) {
-        spawnSync('sudo', ['systemctl', 'restart', 'nanoclaw'], {
+        spawnSync('sudo', ['systemctl', 'restart', unit], {
           stdio: 'ignore',
         });
       }