A security policy requires that the legacy 'telnet.socket' unit never start on a server, even if another service or an administrator attempts to enable or start it. Simply disabling it is not sufficient because a dependent unit keeps pulling it in via socket activation. Which command permanently prevents the unit from being started by any means until reversed?