cistech-tunnel: use /bin/bash in ExecStart for permission resilience

Invoke host-routing.sh via /bin/bash so the watcher service works
even if the execute bit gets cleared by permission resets.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/cistech-tunnel/shared/install-host-services.sh

@@ -31,7 +31,7 @@ After=docker.service
 
 [Service]
 Type=oneshot
-ExecStart=${SCRIPT_DIR}/host-routing.sh restart
+ExecStart=/bin/bash ${SCRIPT_DIR}/host-routing.sh restart
 ExecStartPost=/bin/rm -f ${APP_DATA_DIR}/restart-routing
 ExecStartPost=/bin/bash -c 'echo "trigger cleared at \$(date)" >> ${APP_DATA_DIR}/watcher.log'
 EOF