fix: clawd-rfkill.service failed due to systemd $ expansion

systemd expands $rf as env var (empty), breaking the inline script.
Move rfkill logic to standalone script to avoid escaping issues.
Also use quoted heredoc to prevent bash expansion in install.sh.
