Log each install and update, and keep only the recent logs

Each run's output now goes to ~/.local/state/coredesktop/logs/, so what
failed can be read after the terminal is gone. In a terminal, update runs
itself under script(1), so everything it runs still sees a terminal, then
strips color codes and progress redraws from the log; otherwise it uses
tee. install.sh, usually piped into bash, uses tee, and runs configure
straight on the terminal, outside the log. Both name the log when
something fails. 95-cleanup.sh keeps the newest 10 update logs and 3
install logs.

The sudo keepalive loops no longer share the logged output, so their
sleep can't hold the log open after the run ends.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/update.bats

@@ -16,7 +16,7 @@ setup() {
   done
 
   export RAN="$BATS_TEST_TMPDIR/ran"
-  unset UPDATE_REEXECED UPDATE_PULL_FAILED UPDATE_FORCE
+  unset UPDATE_REEXECED UPDATE_PULL_FAILED UPDATE_FORCE UPDATE_LOG
 
   stub clear
   stub git 'exit "${GIT_STATUS:-0}"'
@@ -167,6 +167,40 @@ ran() {
   [ ! -e "$RAN" ]
 }
 
+@test "update logs its output to one file, across re-running its new copy" {
+  hook 10-a 'echo "hook a ran"'
+
+  run "$CD/update"
+  [ "$status" -eq 0 ]
+  logs=("$HOME"/.local/state/coredesktop/logs/update-*.log)
+  [ "${#logs[@]}" -eq 1 ]
+  grep -q "Updating CoreDesktop" "${logs[0]}"
+  grep -q "hook a ran" "${logs[0]}"
+  grep -q "^Done\.$" "${logs[0]}"
+  [ "$(stat -c %a "$HOME/.local/state/coredesktop/logs")" = 700 ]
+}
+
+@test "when a hook fails, update says where its log is" {
+  hook 10-a 'return 1'
+
+  run "$CD/update"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"The full output is in $HOME/.local/state/coredesktop/logs/update-"*".log"* ]]
+}
+
+@test "clean_log leaves only the text of a terminal session's log" {
+  eval "$(sed -n '/^clean_log() {/,/^}/p' "$REPO/update")"
+  log="$BATS_TEST_TMPDIR/session.log"
+  printf '%s\n' 'Script started on 2026-11-08 10:00:00-07:00 [COMMAND="update"]' > "$log"
+  printf '\033]0;title\007\033[1;32mgreen\033[0m Ünïcode █\r\n' >> "$log"
+  printf '10%%\r50%%\r100%%\r\n' >> "$log"
+  printf '\033[H\033[2J\033[3Jdone\r\n' >> "$log"
+  printf '%s\n' 'Script done on 2026-11-08 10:01:00-07:00 [COMMAND_EXIT_CODE="0"]' >> "$log"
+
+  clean_log "$log"
+  [ "$(cat "$log")" = "$(printf 'green Ünïcode █\n100%%\ndone')" ]
+}
+
 @test "an update from before 2026-10-19 that copies this one over itself hands over to it" {
   # 013acac's update: sudo cp overwrites the file bash is still reading, and
   # bash reads on in the new one from where it was