deploy: ship ump-recall-sidecar.service as installable unit

Until now the ump-recall sidecar was started ad-hoc as a background process
and died with the session. This commit ships the systemd unit file that
makes it persist across reboots and Hermes gateway restarts.

The unit:
  - Listens on 127.0.0.1:4380 (the sidecar port the MCP shim uses)
  - Depends on ump-memory.service (canonical ump store at :4317)
  - Reads env from /etc (UMP_URL, QDRANT_URL, OLLAMA_URL, GRAPH_FILE)
  - Restarts on crash (RestartSec=3)
  - Logs to journal under SyslogIdentifier=ump-recall-sidecar

Verifies cleanly via:  curl http://127.0.0.1:4380/health
Returns upstreams reachable + graph loaded.

Install (idempotent):
  sudo cp deploy/ump-recall-sidecar.service /etc/systemd/system/
  sudo systemctl daemon-reload
  sudo systemctl enable --now ump-recall-sidecar.service

deploy/README.md

@@ -0,0 +1,42 @@
+# Deploy assets
+
+Systemd units to install at `/etc/systemd/system/`.
+
+## ump-recall-sidecar.service
+
+Manages the ump-recall sidecar (`/root/ump-recall/src/server.js`) — the
+RRF-fused retrieval proxy that fronts the canonical ump store, the
+Qdrant vector index, and the Ollama embedding model.
+
+**Install (idempotent):**
+
+```bash
+sudo cp deploy/ump-recall-sidecar.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now ump-recall-sidecar.service
+sudo systemctl status ump-recall-sidecar.service
+```
+
+**Verify:**
+
+```bash
+curl -s http://127.0.0.1:4380/health | python3 -m json.tool
+```
+
+Will auto-restart on crash, after reboot, or after daemon-reload. Logs
+land in the system journal (`journalctl -u ump-recall-sidecar`).
+
+**Dependents:** the ump-recall-mcp.js Hermes MCP shim proxies `recall`
+through this service's `POST /recall` endpoint. Without it active,
+recall falls back to the canonical ump directly (lower quality; no RRF
+fusion, no graph channel).
+
+**Why this exists:**
+
+Before this unit landed (2026-07-14), the sidecar was launched as a
+background `node src/server.js` process under the Hermes session. It
+died whenever Hermes restarted (session close, gateway restart, machine
+reboot). Then `ump.recall` would fall back to canonical ump via the
+shim's fallback path — which works, but loses RRF fusion and the graph
+channel. Now the sidecar is persistent and the MCP recall quality is
+uninterrupted.

deploy/ump-recall-sidecar.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=UMP Recall Sidecar (RRF-fused retrieval for Hermes + Krystie)
+# Depend on both qdrant (RRF channel) and ump-memory (canonical store)
+After=network.target ump-memory.service
+Wants=ump-memory.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/root/ump-recall
+
+# Sidecar exposes RRF-fused recall + /get/{urn} + /health + /embed
+# Sidecar connects OUTBOUND to ump at 4317, qdrant at 6333, ollama at 11434
+Environment=PORT=4380
+Environment=UMP_URL=http://127.0.0.1:4317
+Environment=QDRANT_URL=http://127.0.0.1:6333
+Environment=OLLAMA_URL=http://127.0.0.1:11434
+Environment=GRAPH_FILE=/root/ump-recall/state/graph.json
+Environment=GRAPH_ENABLED=true
+Environment=ACTR_ENABLED=true
+Environment=ACCESS_LOG_ENABLED=true
+
+ExecStart=/usr/bin/node /root/ump-recall/src/server.js
+
+# Always restart — handles OOM kills, crashed req handlers, dev mode restarts
+Restart=always
+RestartSec=3
+
+# Graceful shutdown
+KillSignal=SIGINT
+TimeoutStopSec=10
+
+# Logging (separate identifier so logs/dmesg/journal splits by service)
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=ump-recall-sidecar
+
+[Install]
+WantedBy=multi-user.target