The app-driven update's transcript lands in the app's own HERMES_HOME
(logs/desktop-update-handoff.log, plus the XDG userdata copy) and the driver
already knew to snapshot those places -- but the snapshot ran AFTER
`fail "app-driven update exited $rc"`, so the one leg that needs the transcript
was the one leg that never collected it. The block is now a callable that the
app-update branch invokes the moment its observer returns, with a flag so the
later call stays a no-op.
081f2031fd