Log each install and update, and keep only the recent logs

Each run's output now goes to ~/.local/state/coredesktop/logs/, so what
failed can be read after the terminal is gone. In a terminal, update runs
itself under script(1), so everything it runs still sees a terminal, then
strips color codes and progress redraws from the log; otherwise it uses
tee. install.sh, usually piped into bash, uses tee, and runs configure
straight on the terminal, outside the log. Both name the log when
something fails. 95-cleanup.sh keeps the newest 10 update logs and 3
install logs.

The sudo keepalive loops no longer share the logged output, so their
sleep can't hold the log open after the run ends.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

updates.d/95-cleanup.sh

@@ -10,6 +10,20 @@ if command -v paccache &>/dev/null; then
   sudo paccache -ruk0
 fi
 
+# Keep the newest 10 update logs and 3 install logs (refresh runs install.sh
+# too). Their names sort oldest first.
+keep_newest() {
+  local keep="$1"
+  shift
+  (( $# > keep )) && rm -f -- "${@:1:$# - keep}"
+  return 0
+}
+LOGS="$HOME/.local/state/coredesktop/logs"
+shopt -s nullglob
+keep_newest 10 "$LOGS"/update-*.log
+keep_newest 3 "$LOGS"/install-*.log
+shopt -u nullglob
+
 # makepkg builds pkg-debug alongside an AUR package, and removing the package
 # leaves it behind (asdf-vm-debug). Without its package it's no use to anyone,
 # so remove it without asking. The exact name: pacman -Q herdr finds herdr-bin