fix: move StartLimitIntervalSec and StartLimitBurst to [Unit] section

Fixes #541

systemd was logging warnings:
  Unknown key name 'StartLimitIntervalSec' in section 'Service'
  Unknown key name 'StartLimitBurst' in section 'Service'

These keys belong in the [Unit] section, not [Service].
Moved them from common_hardening to header_common in the correct section.

Verified with:
- dune build (passes)
- dune runtest (211 tests pass)

Author: vch9

CHANGELOG.md

@@ -10,6 +10,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - Renamed "linked directories" to "registered directories" (CLI commands: `binaries link` → `binaries register`, `binaries unlink` → `binaries unregister`)
 
+### Fixed
+
+- Systemd service template warnings about unknown keys `StartLimitIntervalSec` and `StartLimitBurst` in [Service] section (moved to [Unit] section)
+
 ### Removed
 
 - Ghostnet support - Ghostnet testnet has been deprecated and is no longer available as a network option

src/systemd.ml

@@ -286,7 +286,9 @@ let unit_template ~user_mode ~role ~app_bin_dir ~user ?prestart () =
       "[Unit]\n\
        Description=Octez %s (%%i)\n\
        After=network-online.target\n\
-       Wants=network-online.target\n\n\
+       Wants=network-online.target\n\
+       StartLimitBurst=10\n\
+       StartLimitIntervalSec=300s\n\n\
        [Service]\n\
        Environment=APP_BIN_DIR=%s\n\
        Environment=ROLE=%s\n\
@@ -308,8 +310,6 @@ let unit_template ~user_mode ~role ~app_bin_dir ~user ?prestart () =
   let common_hardening =
     "Restart=on-failure\n\
      RestartSec=5s\n\
-     StartLimitBurst=10\n\
-     StartLimitIntervalSec=300s\n\
      NoNewPrivileges=yes\n\
      PrivateTmp=yes\n\
      ProtectSystem=strict\n\