Emit raw JSON from service logs via journalctl -o cat

Strips journalctl's own prefix so each line is pino's raw JSON payload, pipeable into jq for pretty-printing without pulling pino-pretty into runtime dependencies.

README.md

@@ -113,7 +113,7 @@ the script — always as a discrete argv element or env var, never interpolated
 | `triggershell service install [--system]`                                                     | Install a systemd unit that runs `triggershell start` (per-user by default, Linux only)                                                                                                                                |
 | `triggershell service uninstall [--system]`                                                   | Stop, disable, and remove the systemd unit                                                                                                                                                                             |
 | `triggershell service status [--system]`                                                      | Show the systemd unit's status                                                                                                                                                                                         |
-| `triggershell service logs [-n LINES] [--no-follow] [--system]`                               | Tail the systemd unit's logs (wraps `journalctl`)                                                                                                                                                                      |
+| `triggershell service logs [-n LINES] [--no-follow] [--system]`                               | Tail the systemd unit's logs (wraps `journalctl -o cat`, so each line is raw JSON - pipe through `jq` for pretty-printing)                                                                                            |
 
 ### Running scripts from the CLI
 

docs/ARCHITECTURE.md

@@ -76,7 +76,9 @@ targets `/etc/systemd/system/` instead and prints the `sudo` commands to run if
 explicit `systemctl --user enable --now triggershell`, since it's the point where the service
 actually starts listening and running scripts. `triggershell service status`/`uninstall`/`logs` are
 thin wrappers around `systemctl`/`journalctl` respectively - no unit-file parsing or log storage of
-our own, journald already does that.
+our own, journald already does that. `logs` passes `-o cat` so each line is the raw pino JSON
+payload rather than journalctl's own timestamp/hostname/unit prefix - pipeable straight into `jq`
+for pretty-printing without pulling `pino-pretty` into the CLI's runtime dependencies.
 
 ## Cross-module-graph state
 

src/cli/commands/service.ts

@@ -137,7 +137,9 @@ export async function serviceLogsCommand(
 ): Promise<void> {
   const scope = scopeOf(opts);
   const args = scope === "user" ? ["--user"] : [];
-  args.push("-u", SERVICE_NAME);
+  // -o cat strips journalctl's own prefix (timestamp/hostname/unit) so each line is the raw pino
+  // JSON payload - pipeable straight into `jq` or similar without journalctl's wrapper in the way.
+  args.push("-u", SERVICE_NAME, "-o", "cat");
   if (opts.follow !== false) args.push("-f");
   if (opts.lines !== undefined) args.push("-n", String(opts.lines));