v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

Capture layer: applog.New returns (logger, Ring) — slog fan-out, stderr at the
configured level, ~1000-entry ring fixed at LevelDebug (remote diagnostics
without a config flip). GET /debug/logs (token-authed, ?raw=1) + request-level
DEBUG middleware. Heartbeat log-pull mirrors the report logtail pattern:
envelope log_tail_requested -> next heartbeat carries log_tail (128KB cap,
consume-once, failed-push retry proven). Gap-fill sweep over netverify/
netstorage/netmount/signedjobs/selfupdate/disks/controller-swap/desired/loop.
Red-proofs: ring-at-emit-level FAILs capture test; drain removed FAILs
consume-once; dropped phase line FAILs the S7 log-sequence smoke.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/selfupdate/executor.go

@@ -98,6 +98,7 @@ func (e *Executor) Execute(ctx context.Context, op string, params json.RawMessag
 	if e.runner == nil {
 		return fmt.Errorf("agent_update: no wrapper runner configured")
 	}
+	e.logger.Debug("agent_update: op invariants passed (semver + sha format)", "version", p.Version)
 
 	dir := stagingDir(e.stateDir)
 	if err := os.MkdirAll(dir, 0o750); err != nil {
@@ -107,11 +108,14 @@ func (e *Executor) Execute(ctx context.Context, op string, params json.RawMessag
 	url := interpolateURL(e.urlTemplate, p.Version)
 
 	e.logger.Warn("agent_update: downloading operator-signed binary", "version", p.Version, "url", url, "sha256", p.SHA256)
+	dlStart := time.Now()
 	got, err := e.download(ctx, url, staged)
 	if err != nil {
 		_ = os.Remove(staged)
 		return fmt.Errorf("agent_update: download %s: %w", url, err)
 	}
+	e.logger.Debug("agent_update: download complete", "version", p.Version,
+		"sha_match", got == p.SHA256, "duration_ms", time.Since(dlStart).Milliseconds())
 	// The signed sha is the ONLY integrity root — verify BEFORE anything touches the live binary.
 	if got != p.SHA256 {
 		_ = os.Remove(staged)