Let Dev Updater supervise the backend, now that the switch can be sequenced

Re-applies the change reverted in d5a0f67. It was right then and only
mistimed: something was reading this working tree live, so deleting the
script took the backend card to "couldn't check" immediately rather than
on a pull. Iris has now uninstalled the service while the script was still
the declared one, which is the step that stops the old unit being orphaned
under a name nothing points at any more.

`Managed` runs the command with dev-updater's built-in service script,
resolved against the component's cwd. ai-app's own script was the generic
case exactly -- ExecStart=$BINARY with no arguments and no environment --
so it was 233 lines of init-system detection kept in step with an
identical copy next door.

Deleting it loses nothing, and that was checked rather than assumed: all
three findings the test guest produced today are in the built-in --
reading OpenRC's status exit code instead of grepping text it prints to
stderr, treating an uninitialised user softlevel as "couldn't find out"
rather than as stopped, and assigning through `|| code=$?` so `set -e`
cannot kill the script before it reads the code.

The one thing the script said that the built-in cannot is already in
AGENTS.md: Stop on this card takes down the server a phone reaches through
the tunnel, while Dev Updater itself is unaffected because it uses its own
port.

Install from the backend card after taking this.

.dev-updater.ron

@@ -18,9 +18,17 @@ components: [
         name: "backend",
         build: "cargo build --release",
         cwd: "server",
-        // Installs into whichever user-service manager is here, and is how
-        // ai-server is started, stopped and asked about. See the script.
-        service: "server/service",
+        // Dev Updater's own built-in service implementation, generated
+        // into its data directory and driven through the same interface a
+        // project-supplied script would be. ai-app carried a script of its
+        // own until 2026-08-28; it ran `target/release/ai-server` with no
+        // arguments and no environment, which is the generic case exactly,
+        // so it was two copies of one thing and the copy that could not be
+        // tested from here -- the OpenRC branch -- was duplicated with it.
+        //
+        // Resolved against this component's `cwd`, so this is
+        // `server/target/release/ai-server`.
+        service: Managed("target/release/ai-server"),
     ),
     Apk(
         name: "app",