Adds to the operator guide: a systemd unit and a rootless podman quadlet
(the production host uses systemd), a sysvinit script for hosts without
it, a wrapper script for the run line, and the in-image upgrade path.

The service examples carry the two traps worth inheriting from the build
machine's own scripts: the CONTAINER is the source of truth for "is it
running", not the launcher, because dockerd outlives the shell and
`run --rm --name` dies on a name conflict; and a boot-time shell has
neither your env nor your PATH, which is why the live-code switch is a
flag FILE and the runner path is spelled out.

The upgrade section documents what `coderai-docker --upgrade` actually
does (shallow clone, version gate, swap /opt/coderai/app, delta pip, exit
0/10, host commits back onto the same tag) and says plainly when NOT to
use it: it mutates a tag in place, so afterwards the local image is no
longer byte-identical to the signed one in the registry.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>