Arch package: start the service and let the GUI reach the agent

The control socket is now opened to the tsunagi group (unit), the Arch
package enables and starts the service on install, adds the installing user
to the group, restarts a running agent on upgrade, and depends on the
libraries the tray loads at run time. The tray looks for the agent's socket
again on every poll instead of once at start, and a missing indicator
library is reported instead of panicking. Repository URLs unified.

Co-Authored-By: Claude <noreply@anthropic.com>

dist/linux/README.md

@@ -22,7 +22,9 @@ and `CAP_NET_BIND_SERVICE` (granted by systemd), not root. systemd creates its
 state (`/var/lib/tsunagi`), cache (`/var/cache/tsunagi`) and runtime
 (`/run/tsunagi`) directories, and the polkit rule lets it configure the
 resolver. Control it with `sudo` — the CLI finds the running service's socket at
-`/run/tsunagi/agent.sock` with no flags:
+`/run/tsunagi/agent.sock` with no flags. The socket is open to the `tsunagi`
+group, so after `sudo usermod -aG tsunagi "$USER"` (and logging in again) no
+`sudo` is needed:
 
 ```sh
 sudo tsunagi status

dist/linux/tsunagi.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=tsunagi mesh agent
-Documentation=https://github.com/Ultradesu/tsunagi
+Documentation=https://github.com/house-of-vanity/tsunagi
 After=network-online.target
 Wants=network-online.target
 
@@ -16,7 +16,8 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 
 # systemd creates and owns these for the service user, and the agent is pointed
 # at them: state in /var/lib/tsunagi, cache in /var/cache/tsunagi, and the
-# control socket in /run/tsunagi, which stays private to the service user.
+# control socket in /run/tsunagi. The socket is opened to the `tsunagi` group,
+# so a user who joins it can run the CLI and the tray without sudo.
 StateDirectory=tsunagi
 StateDirectoryMode=0700
 CacheDirectory=tsunagi
@@ -25,6 +26,7 @@ RuntimeDirectoryMode=0755
 Environment=TSUNAGI_STATE_DIR=%S/tsunagi
 Environment=TSUNAGI_CACHE_DIR=%C/tsunagi
 Environment=TSUNAGI_CONTROL_SOCKET=%t/tsunagi/agent.sock
+Environment=TSUNAGI_CONTROL_GROUP=tsunagi
 
 # The tarball installer puts the binary here; the deb and the Arch package
 # rewrite this to /usr/bin where they install it.