feat(b5): add systemd unit files for CI periodic tasks (Linux host)

Implements the repo-side artifacts of Phase B5 (plans/implementation-plan-A-B.md). Creates 5 .service + .timer pairs under deploy/systemd/ that replicate the periodic tasks registered on Windows by scripts/Register-CIScheduledTasks.ps1:

  - ci-cleanup-orphans       -> python -m ci_orchestrator vm cleanup --max-age-hours 6 (every 6h + boot)

  - ci-retention-policy      -> pwsh Invoke-RetentionPolicy.ps1 (daily 03:00)

  - ci-watch-disk-space      -> python -m ci_orchestrator monitor disk (every 15min)

  - ci-watch-runner-health   -> python -m ci_orchestrator monitor runner (every 15min)

  - ci-backup-template       -> pwsh Backup-CITemplate.ps1 (weekly Sun 02:00, NEW)

Includes deploy/systemd/README.md with mapping table, install/test/rollback instructions, and PowerShell Core install note for the two PS-only scripts. Plan checklist updated; B5-closeout.md added. Hardware install steps (systemctl enable + smoke) remain user responsibility on the Linux host.

deploy/systemd/ci-backup-template.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Local CI/CD — weekly backup of VMware templates
+Documentation=file:///opt/ci/local-ci-cd-system/deploy/systemd/README.md
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=ci-runner
+Group=ci-runner
+EnvironmentFile=/etc/ci/environment
+WorkingDirectory=/opt/ci/local-ci-cd-system
+# NOTE: requires PowerShell Core (`pwsh`) on the Linux host.
+# See deploy/systemd/README.md "Nota PowerShell su Linux".
+ExecStart=/usr/bin/pwsh -NoProfile -NonInteractive -File scripts/Backup-CITemplate.ps1
+TimeoutStartSec=4h
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+Nice=19
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+NoNewPrivileges=true
+ReadWritePaths=/var/lib/ci /var/backups/ci
+
+[Install]
+WantedBy=multi-user.target