Add the shared Claude Remote Control setup

Units, settings and setup README for the claude-rc user, which serves my projects' read-only MCP servers to the Claude app (negsplit for now).

.config/claude-rc/claude-rc.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=Claude Code Remote Control (read-only MCP servers)
+Wants=network-online.target
+After=network-online.target mariadb.service
+# about 50 min of failed starts (back-off below): give up and notify
+StartLimitIntervalSec=1h
+StartLimitBurst=8
+OnFailure=claude-rc-notify.service
+
+[Service]
+User=claude-rc
+Group=claude-rc
+WorkingDirectory=/var/lib/claude-rc/data
+# strips credentials from subprocess environments; on Linux also sandboxes ! shell commands
+Environment=CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1
+ExecStart=/usr/bin/claude remote-control --name data --spawn session
+Restart=always
+RestartSec=30s
+RestartSteps=4
+RestartMaxDelaySec=10min
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/claude-rc
+PrivateTmp=yes
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectClock=yes
+ProtectHostname=yes
+CapabilityBoundingSet=
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+# no RestrictNamespaces/MemoryDenyWriteExecute: the Bash sandbox (bubblewrap) needs user namespaces
+
+[Install]
+WantedBy=multi-user.target