feat(host): project-orchestrator systemd unit (always-on, no wakes)

The PO is the operator's fleet-management Remote Control point; until now nothing
brought it back after a reboot. Mirrors lichen-orchestrator: oneshot + RemainAfterExit
running `agents.py up` as loops, which starts the PO agent and its watchdog. The PO's
agents.toml declares no `wake`, so the watchdog only heals a dead session — it never
sends periodic prompts.

Also lands the /mnt/data hardware.nix mount (by-uuid + nofail) that was sitting
uncommitted; fstab output is unchanged from the running system.

Deployed 2026-08-01: build delta was 5 derivations (the new unit + etc/system-units);
every other unit file byte-identical, dry-activate showed only a dbus reload. The
in-flight pi-coding-agent / launch.py work is parked on wip/pi-orchestrator-2026-08-01.

Co-Authored-By: Claude <noreply@anthropic.com>

nix/hosts/cc-ci-orchestrator-hetzner/hardware.nix

@@ -13,4 +13,21 @@
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
   boot.initrd.kernelModules = [ "nvme" ];
   fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+
+  # 150G Hetzner volume (scsi-0HC_Volume_106342723) — holds the Rust build trees, which repeatedly
+  # filled the 75G root. A full disk here does NOT error: it silently truncates whatever is being
+  # written (it destroyed a plan file mid-write before anyone noticed).
+  #
+  # by-uuid, not /dev/sdb: device names are not stable across reboots and attaching another volume
+  # would silently mount the wrong disk here.
+  #
+  # nofail is REQUIRED, not decoration: without it, a detached/failed volume makes the mount unit a
+  # boot dependency, systemd drops to emergency mode, and the box comes up WITHOUT SSH. That failure
+  # has already happened once on this host from a bad nixos config, and it needed a recovery to the
+  # previous generation. The build cache is not worth risking access to the machine.
+  fileSystems."/mnt/data" = {
+    device = "/dev/disk/by-uuid/16cd6650-1399-4cb9-a696-54b70d83203a";
+    fsType = "ext4";
+    options = [ "defaults" "nofail" "x-systemd.device-timeout=10s" ];
+  };
 }