Add remain:yes option for run/task oneshot commands

Similar to systemd's RemainAfterExit=yes.  Prevents the task from
re-running on runlevel re-entry and ensures the post: script runs
when explicitly stopped or when leaving valid runlevels.

Useful for tasks that set up persistent state like firewall rules:

    task [2345] remain:yes \
         post:/usr/sbin/teardown-firewall \
         /usr/sbin/setup-firewall -- Firewall setup

Not supported for bootstrap-only tasks (runlevel S only) since these
are deleted immediately after completion.

src/sm.c

@@ -461,6 +461,9 @@ restart:
 		/* First reload all *.conf in /etc/finit.d/ */
 		conf_reload();
 
+		/* Handle remain tasks that need to run post script before restart */
+		service_runtask_clean();
+
 		/*
 		 * Then, mark all affected service conditions as in-flux and
 		 * let all affected services move to WAITING/HALTED