Pin service install --instance unit isolation (G2h: separate units + ExecStart flags)

Summary

• G2h composes G1h's multi-instance register isolation with the systemd service-lifecycle layer. After two instances are registered (Alpha + Beta), service install --instance NAME for each must produce two distinct units with the correct --instance flag in ExecStart and both enabled simultaneously.
• Three direct contract pins:
  1. Default service name for --instance NAME is squid-tentacle-{NAME} (NOT plain squid-tentacle)
  2. Each unit's ExecStart contains --instance <name> (so each agent loads its own config at boot)
  3. Both units coexist as is-enabled
• Two reverse-pins:
  • /etc/systemd/system/squid-tentacle.service MUST NOT exist after install with named instances (catches DefaultServiceName fallback regression)
  • Alpha unit MUST NOT mention Beta's name (templating-mix regression)

Why this completes the multi-instance happy path

G1h proved register isolation (configs, cert dirs, machine-name payloads). G2h proves the lifecycle isolation continues into systemd. Together they cover the documented operator workflow create-instance → register → service install for two named instances end-to-end.

Test plan

• dotnet build green (0 errors)
• CI tentacle-linux-e2e workflow passes G2h_TwoInstances_ServiceInstall_CreatesSeparateUnitsWithInstanceFlag
• G2h asserts: 2 distinct unit paths exist + /etc/systemd/system/squid-tentacle.service does NOT exist + each ExecStart contains its own --instance flag + Alpha unit does not mention Beta + both is-enabled
• Existing 41 Linux E2E tests still pass (G1h continues to pass with extended context)

🤖 Generated with Claude Code