v0.15.1

Highlights

This release hardens the upgrade run lifecycle introduced in v0.15.0 —
persisted, reconciled on restart, and surfaced on failure.

• #126 — Upgrade run lifecycle: the run becomes a single source-of-truth
  state machine whose verdict is the state itself (idle / running /
  failed), persisted across restarts and reconciled against systemd on
  startup, with a failed run now surfaced in the UI.

✨ Features

• Persisted run state machine — the former running-flag / progress-snapshot
  pair (which could drift) collapses into one run type. The verdict is the
  state itself: idle (none or last succeeded), running, failed. A run is
  owned by its source — a unit-triggered run takes its verdict from the systemd
  job over the bus; a CLI/out-of-band run is driven by the progress socket and
  its end line.
• Restart-safe runs — the snapshot is persisted to a state file (parent dir
  created on write) and reconciled on startup: a still-activating unit resumes
  with its in-flight percent intact across a graceful self-upgrade restart, an
  already-terminal unit surfaces the verdict missed while down. GET /upgrade
  always carries run.

🎨 UI

• Failure badge — a failed run shows a red alert badge in the header that
  swaps to the green upgrade arrow on hover to retry, persisting until the next
  run.

🧹 Internal

• systemdControl interface — the systemd dependency sits behind a small
  interface, making the trigger/resume paths unit-testable (~87% coverage).
• Lifecycle logging — the run lifecycle and its persistence are logged
  throughout for diagnosability.

Full changelog: v0.15.0...v0.15.1