Log each install and update, and keep only the recent logs

Each run's output now goes to ~/.local/state/coredesktop/logs/, so what
failed can be read after the terminal is gone. In a terminal, update runs
itself under script(1), so everything it runs still sees a terminal, then
strips color codes and progress redraws from the log; otherwise it uses
tee. install.sh, usually piped into bash, uses tee, and runs configure
straight on the terminal, outside the log. Both name the log when
something fails. 95-cleanup.sh keeps the newest 10 update logs and 3
install logs.

The sudo keepalive loops no longer share the logged output, so their
sleep can't hold the log open after the run ends.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

update

@@ -35,6 +35,31 @@ install_script() {
     tmp="$(mktemp "$2.XXXXXX")" && cp "$1" "$tmp" && chmod 755 "$tmp" && mv -f "$tmp" "$2"
 }
 
+# Make a log written by script(1) readable: drop its header and footer, color
+# and cursor codes, and all but the last redraw of each progress line. LC_ALL=C
+# so the ranges below mean bytes, whatever the locale.
+clean_log() {
+    LC_ALL=C sed -i -E '1{/^Script started on /d}; /^Script done on .*COMMAND_EXIT_CODE/d;
+        s/\x1b\][^\x07\x1b]*(\x07|\x1b\\)//g; s#\x1b\[[0-9;?]*[ -/]*[@-~]##g;
+        s/\x1b[()][0-9A-Za-z]//g; s/\x1b[=>]//g; s/\r+$//; s/.*\r//' "$1"
+}
+
+# Log each update to ~/.local/state/coredesktop/logs (95-cleanup.sh deletes
+# old ones). In a terminal, run under script(1), so everything still sees a
+# terminal and colors, menus and prompts work as before; otherwise use tee.
+# UPDATE_LOG tells the copy re-run below that it's already logging.
+if [[ -z "$UPDATE_LOG" ]] && mkdir -p -m 700 "$HOME/.local/state/coredesktop/logs"; then
+    UPDATE_LOG="$HOME/.local/state/coredesktop/logs/update-$(date +%Y-%m-%d-%H%M%S).log"
+    export UPDATE_LOG
+    if [ -t 0 ] && [ -t 1 ] && command -v script > /dev/null; then
+        SHELL=/bin/bash script -q -e -f -c "$(printf '%q ' "$0" "$@")" "$UPDATE_LOG"
+        status=$?
+        clean_log "$UPDATE_LOG"
+        exit "$status"
+    fi
+    exec > >(tee -a "$UPDATE_LOG") 2>&1
+fi
+
 # Print the logo
 print_logo() {
     cat << "EOF"
@@ -88,7 +113,7 @@ fi
 # Ask for the password once, then keep sudo's cached credentials fresh until
 # update exits, so long-running hooks don't stop for a password again.
 sudo -v || exit 1
-while kill -0 $$ 2>/dev/null; do sudo -n -v; sleep 60; done 2>/dev/null &
+while kill -0 $$ 2>/dev/null; do sudo -n -v; sleep 60; done > /dev/null 2>&1 &
 SUDO_KEEPALIVE_PID=$!
 trap 'kill "$SUDO_KEEPALIVE_PID" 2>/dev/null' EXIT
 
@@ -119,6 +144,7 @@ done
 
 if (( ${#FAILED[@]} > 0 )); then
     echo "Done, with errors in: ${FAILED[*]}"
+    [ -n "$UPDATE_LOG" ] && echo "The full output is in $UPDATE_LOG"
     exit 1
 fi