The service updates itself through the existing launcher handshake once the
update window is open, and the launcher now prunes old runtimes and restarts
a crashing child with backoff. The process ledger, crash-loop downgrade,
shell prompt injection, restart announcement, and kept web assets are gone.
The earlier implementation is replaced by the smaller one merged here.