Guard writer units against activation and fix backup cancellation

update.sh

@@ -256,7 +256,7 @@ if [[ $UP_WORKER == false ]]; then
   # The launcher must not keep copies of our locks; systemd starts a fresh worker.
   systemd-run --no-block --unit=app-backup-upgrade --collect --property=Type=oneshot \
     --property=SELinuxContext=system_u:system_r:unconfined_service_t:s0 \
-    --property=TimeoutStartSec=24h --property=TimeoutStopSec=5min --property=KillMode=mixed \
+    --property=TimeoutStartSec=24h --property=TimeoutStopSec=5min --property=KillMode=control-group \
     /bin/bash "$UPDATE_ROOT/update.sh" --worker "$UP_STATE" 8>&- 9>&- || {
       # Revoke the queued state while still holding the coordinator lock. Even
       # if systemd accepted the job but its reply failed, it must not install.
@@ -281,7 +281,8 @@ fi
 # -------------------- detached worker --------------------
 [[ $UP_STATE == /var/backups/app-backup-upgrade-* && -d $UP_STATE && ! -L $UP_STATE && $(stat -c %u "$UP_STATE") == 0 ]] || die 'Invalid upgrade state directory'
 (( (8#$(stat -c %a "$UP_STATE") & 8#077) == 0 )) || die 'Upgrade state must be private'
-exec > >(tee -a "$UP_STATE/update.log") 2>&1
+# The group receives TERM together; keep logging available for child recovery.
+exec > >(trap '' INT TERM; exec tee -a "$UP_STATE/update.log") 2>&1
 CONFIG_FILE=$(cat "$UP_STATE/config-path")
 LOCKFILE=$(cat "$UP_STATE/lock-path")
 UP_CHANGED=false