Keep update boot journal on data mount

[DaniusKalv]

Hardware validation of #45 found that a boot which comes up locked keeps its journal in RAM only, so a failed update boot leaves nothing behind. Both silent failures in that round were diagnosed from update.json alone.

Mitigated in the update path: each run now copies its own journal to /var/lib/camlab/update.log before rebooting. That covers the updater and nothing else and it misses the lines written after copy.

The real fix is a journal that survives reboot on a read-only box, either by pointing /var/log/journal at the data mount or by keeping a persistent journal for update boots only.

[DaniusKalv]

Round two hardware validation measured the mitigation and found it hollow: _save_log snapshotted the journal from inside still-running unit, so a successful 30 s run captured 95 of 98 lines while both failure runs captured one. The failure never reached the file.

eat/update-shim moves the copy into ExecStopPost as a camlab-update savelog verb, after ExecStart has died, so it now carries the error that ended the run. The mitigation only works from that point.

The issue stays open for the real fix, a journal that survives a reboot on a locked box.