Why: systemd's default KillMode=control-group kills every process in the unit's cgroup when the oneshot finishes -- the daemon recover just started died seconds after the recover ok event (observed live on the host: revived at 22:13:40, gone by 22:13:42). Evidence: unit text now carries KillMode=process (asserted in test_watchdog_print_plan); suite 10/10 and make test-governance rerun recorded on the card; live re-demo on the host after merge. Impact: scripts/svc.sh wd_service_text only. Refs: .task/feature-svc-autorecover.md