Reload the service manager's units before restarting a service whose files changed, and start the guard before the network as the controller declares it (hq ADR 0100)

internal/system/arch.go

@@ -246,3 +246,11 @@ func (arch) AddUserToGroup(ctx context.Context, run Runner, name, group string)
 	}
 	return nil
 }
+
+// ReloadUnits has systemd read its unit files again. A unit file that changed on disk is otherwise
+// ignored: a restart runs the unit systemd already loaded, and the new text only takes effect
+// after a reload nobody asked for.
+func (arch) ReloadUnits(ctx context.Context, run Runner) error {
+	_, err := run(ctx, "systemctl", "daemon-reload")
+	return err
+}