Make systemd hide other users' processes and kernel internals with ProtectProc=invisible and ProtectKernelTunables

Documented steps

1. Add ProtectProc=invisible to the [Service] section to mount /proc read-only with hidepid=invisible so the service only sees its own processes (needs User= or DynamicUser= to take effect)
2. Pair with ProcSubset=pid to hide non-process files in /proc for the strictest posture (rarely needed)
3. Add ProtectKernelTunables=yes to make /proc/sys, /sys, /proc/sysrq-trigger, /proc/latency_stats, /proc/acpi and /proc/irq read-only, and ProtectKernelLogs=yes to block reading the kernel log ring buffer (dmesg)
4. Add ProtectKernelModules=yes to prevent loading/unloading kernel modules, and ProtectControlGroups=yes to mount /sys/fs/cgroup read-only
5. Because ProtectProc= implies MountAPIVFS=, systemd mounts a fresh /proc and /sys in a private mount namespace
6. Restart and verify from inside the service: ps aux should list only its own processes, and cat /proc/kmsg or dmesg should be denied
7. Ensure User=<name> or DynamicUser=yes is set, otherwise ProtectProc= has no effect on visibility