ops(systemd): exact mount match in status, add detached rollback script

Two things surfaced by the production promotion.

`status` counted namespace mounts with an unanchored grep, so on production
"run/netns/openfut" also matched "openfut-staging" and reported a phantom
"2 = leaked stack" against a perfectly healthy host. A status command that
invents a fault is the same class of bug as a unit that reports active while
serving nobody, so it is fixed with an exact mount-point match. The bind and
reconcile logic is untouched; it always umounted an exact path.

openfut-rollback-detached.sh makes the documented rollback executable rather
than a paragraph in a runbook: it removes supervision, resolves the anchor's
CURRENT pid from Docker, and relaunches the incumbent detached pair with the
environment replayed from the captured env.json. --dry-run prints the exact
commands and touches nothing, which is how it was validated while production
was still being served by the processes it would restore.

scripts/systemd/openfut-supervision-install.sh

@@ -78,7 +78,11 @@ case "$ACTION" in
         match="MISMATCH"; [ "$ns" = "$want" ] && match="ok"
         printf '  %-40s pid=%-8s ns=%-18s %s\n' "$u" "$mp" "$ns" "$match"
     done
-    echo "  netns mounts on /run/netns/$NSNAME: $(grep -c "run/netns/$NSNAME" /proc/mounts || true) (1 = healthy, >1 = leaked stack)"
+    # Exact mount-point match. A substring grep for "openfut" also counts
+    # "openfut-staging" and reports a phantom leaked stack on production —
+    # a monitoring lie of exactly the kind this tooling exists to remove.
+    mounts="$(awk -v t="/run/netns/$NSNAME" '$2==t {n++} END {print n+0}' /proc/mounts)"
+    echo "  netns mounts on /run/netns/$NSNAME: $mounts (1 = healthy, >1 = leaked stack)"
     ;;
 
   uninstall)