Service: always-on update log + "View service update log" menu item

Local checkpoint - NOT for public release. Ed wants logging for the service updating.

- New ALWAYS-ON update log at ProgramData\RemSound\service\update.log (not gated on the
  service-logging toggle - updates are rare but important). It records the full sequence:
    * "update detected: newer RemSound.exe (5.3) found, running 5.2 - restarting"
    * the restarter's own "stopping" / "service started" (or "START FAILED - <reason>")
    * "update complete: now running version 5.3"
  The restart PowerShell writes its stop/start outcome itself, so the part that runs AFTER
  the old service process is gone - and any failed start - is still captured. A pending
  marker set at detection and consumed on the next start closes the loop (its absence flags
  a stuck update).
- Service menu gains "View service update log" to open it (friendly message if none yet).

Update log + pending-marker round-trip covered by the isolation self-test. Gate 27/27.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/RemSound.App/SelfTest.cs

@@ -736,6 +736,14 @@ internal static class SelfTest
                 // Running status (version + start time) round-trips — this is what the Service menu shows.
                 ServiceStore.SaveStatus(new ServiceStore.ServiceStatus { Version = "5.3", StartedUtc = DateTime.UtcNow });
                 Check(ServiceStore.LoadStatus()?.Version == "5.3", "the service running-status version must round-trip");
+
+                // Update log + pending marker: the always-on trail of a self-update.
+                ServiceStore.AppendUpdateLog("update detected: test");
+                Check(File.Exists(ServiceStore.UpdateLogPath) && File.ReadAllText(ServiceStore.UpdateLogPath).Contains("update detected: test"),
+                    "the update log must be written");
+                ServiceStore.SetUpdatePending();
+                Check(ServiceStore.ConsumeUpdatePending(), "a set update-pending marker must be consumed once");
+                Check(!ServiceStore.ConsumeUpdatePending(), "the update-pending marker must not be consumed twice");
             }
             finally { ServiceStore.TestDirectoryOverride = saved; }