Align stats persistence path with service defaults

[boeing23]

Summary

• move generated and migrated stats persistence defaults to /var/lib/clawshell/stats.json
• create and chown /var/lib/clawshell during onboarding
• allow the hardened Linux systemd unit to write stats under /var/lib/clawshell
• fix the DLP action default comment in the example config

Why

The README recommends /var/lib/clawshell/stats.json because /etc/clawshell is read-only under the hardened systemd unit, but generated and migrated configs still pointed stats persistence at /etc/clawshell/stats.json. On Linux, ProtectSystem=strict also requires an explicit ReadWritePaths entry for /var/lib/clawshell.

Validation

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test