Service: complete staged upgrade after unmount or restart

Add PendingUpgradeHandler to apply staged upgrades using atomic file
moves (old files to PreviousVersion, staged files to install dir).
Skips GVFS.Service.exe (already replaced by installer, locked by
running service).

Safety mechanisms:
- .ready marker: rejects PendingUpgrade if installer was interrupted
- .phase1-complete marker: ensures crash during backup is recoverable
  (incomplete Phase 1 is restored and retried, not skipped)
- Defers if any GVFS.Mount processes are still running

Trigger upgrade in two ways:
- On service start: checks before automount
- After repo unmount: timer-based debounce (5s) so multiple unmounts
  in quick succession result in a single upgrade attempt

Assisted-by: Claude Opus 4.6
Signed-off-by: Tyrie Vella <tyrielv@gmail.com>

Author: tyrielv

GVFS/GVFS.Service/GVFSService.Windows.cs

@@ -43,6 +43,12 @@ public void Run()
                 metadata.Add("Version", ProcessHelper.GetCurrentProcessVersion());
                 this.tracer.RelatedEvent(EventLevel.Informational, $"{nameof(GVFSService)}_{nameof(this.Run)}", metadata);
 
+                // Check for a staged upgrade before doing anything else.
+                // If no GVFS.Mount processes are running (typical at boot or after
+                // unmount-all), copy staged files in-place and proceed normally.
+                // If mounts ARE running, the upgrade is deferred to next restart.
+                PendingUpgradeHandler.TryApplyPendingUpgrade(this.tracer);
+
                 this.repoRegistry = new RepoRegistry(
                     this.tracer,
                     new PhysicalFileSystem(),

GVFS/GVFS.Service/Handlers/RequestHandler.cs

@@ -1,6 +1,7 @@
 using GVFS.Common.NamedPipes;
 using GVFS.Common.Tracing;
 using System.Runtime.Serialization;
+using System.Threading;
 
 namespace GVFS.Service.Handlers
 {
@@ -14,6 +15,8 @@ namespace GVFS.Service.Handlers
     /// </summary>
     public class RequestHandler
     {
+        private const int PendingUpgradeDelayMs = 5000;
+
         protected const string EnableProjFSRequestDescription = "attach volume";
         protected string requestDescription;
 
@@ -25,6 +28,7 @@ public class RequestHandler
         private string etwArea;
         private ITracer tracer;
         private IRepoRegistry repoRegistry;
+        private Timer pendingUpgradeTimer;
 
         public RequestHandler(ITracer tracer, string etwArea, IRepoRegistry repoRegistry)
         {
@@ -80,6 +84,14 @@ protected virtual void HandleMessage(
                     UnregisterRepoHandler unmountHandler = new UnregisterRepoHandler(tracer, this.repoRegistry, connection, unmountRequest);
                     unmountHandler.Run();
 
+                    // After unmount, check for pending staged upgrade on a
+                    // background thread. The deferred check gives the calling
+                    // GVFS.Mount process time to exit so its executable is no
+                    // longer locked when the upgrade runs.
+                    // Use the long-lived service tracer, not the scoped activity
+                    // tracer which will be disposed when this handler returns.
+                    this.TryDeferredPendingUpgradeCheck(this.tracer);
+
                     break;
 
                 case NamedPipeMessages.GetActiveRepoListRequest.Header:
@@ -121,5 +133,35 @@ private void TrySendResponse(
                 tracer.RelatedError($"{nameof(this.TrySendResponse)}: Could not send response to client. Reply Info: {message}");
             }
         }
+
+        private void TryDeferredPendingUpgradeCheck(ITracer tracer)
+        {
+            string installDir = Service.Configuration.AssemblyPath;
+            string pendingUpgradeDir = System.IO.Path.Combine(installDir, PendingUpgradeHandler.PendingUpgradeDirectoryName);
+            if (!System.IO.Directory.Exists(pendingUpgradeDir))
+            {
+                return;
+            }
+
+            // Debounce: reset the timer on each unmount so the check fires
+            // once after the last unmount settles. If multiple repos unmount
+            // in quick succession, only one upgrade attempt runs.
+            if (this.pendingUpgradeTimer == null)
+            {
+                this.pendingUpgradeTimer = new Timer(
+                    _ =>
+                    {
+                        tracer.RelatedInfo("TryDeferredPendingUpgradeCheck: Checking pending upgrade after unmount");
+                        PendingUpgradeHandler.TryApplyPendingUpgrade(tracer);
+                    },
+                    null,
+                    PendingUpgradeDelayMs,
+                    Timeout.Infinite);
+            }
+            else
+            {
+                this.pendingUpgradeTimer.Change(PendingUpgradeDelayMs, Timeout.Infinite);
+            }
+        }
     }
 }