The rbw unlock systemd services were failing to launch the rbw-agent
daemon due to two issues:
1. Missing RBW_AGENT environment variable - rbw looks for this variable
to locate the agent binary, falling back to PATH lookup. Systemd
user services have minimal environments without the necessary PATH.
2. Default KillMode=control-group - when the oneshot service completed,
systemd was killing all processes in the cgroup including the
daemonized agent.
Fixed by:
- Setting RBW_AGENT environment variable to explicit agent binary path
- Using KillMode=process to only kill the main process, allowing the
spawned agent daemon to persist after service completion