docs(privacy): update.log is a file tty7 writes, so list it

The privacy page accounts for every file tty7 leaves in the config
directory, and `crash.rs` has a test holding it to that. The test named
two files. There are three: the updater appends `<config>/update.log`
while it installs a release — what it verified, what it replaced, and why
it stopped if it did.

It is written whenever an update runs, not only under `TTY7_LOG`. That
makes it exactly what the test's own comment describes as belonging on
the page: "a file written without being asked for". It is also the only
account of a swap that happens after the window is gone, which is why it
exists.

The guard now names all three, and was checked against the page as it
was.

Also corrects a filename I got wrong in the previous commit: the doc
comment on `install_crash_log` called this file `tty7-updater.log`. There
is no such file — I invented the name while describing what a silent
panic costs, and it went in unchecked. It is `update.log`, and finding
that is what turned up the missing page entry.

crates/tty7-core/src/core/crash.rs

@@ -96,7 +96,7 @@ mod tests {
     #[test]
     fn the_files_this_crate_leaves_behind_are_on_the_privacy_page() {
         const PRIVACY: &str = include_str!("../../../../docs/reference/privacy.mdx");
-        for file in ["crash.log", "tty7.log"] {
+        for file in ["crash.log", "tty7.log", "update.log"] {
             assert!(
                 PRIVACY.contains(file),
                 "{file} is written to the config directory but not on the privacy page"

docs/reference/privacy.mdx

@@ -59,4 +59,5 @@ Both of the above honour `http_proxy`. [Updates →](/reference/updates#proxies)
 | Pane scrollback tails | `<config>/scrollback/*.bin`, mode `0600` on Unix and behind the config directory's ACL on Windows. 256 KiB per pane, kept only until something can no longer ask for it: closing a pane deletes its file at once, a restore consumes it, and a periodic pass collects the rest. |
 | Shell history | Your shell's own file, exactly as before — unless you turned on per-pane history, which merges back into it. |
 | Crash reports | `<config>/crash.log`, appended whenever tty7 panics: the time, the version, the panic message and a backtrace. Capped at 256 KiB. Nothing uploads it — it is there for you to read, and to attach to an issue if you choose. |
+| Update log | `<config>/update.log`, appended by the updater while it installs a release: what it verified, what it replaced, and why it stopped if it did. Written whenever an update runs, not only under `TTY7_LOG` — the swap happens after the window is gone, so this is the only account of it. Nothing uploads it. |
 | Diagnostic log | `<config>/tty7.log`, written **only** while `TTY7_LOG` (or `RUST_LOG`) is set; unset, there is no log at all. At `info` it records the daemon and connection lifecycle. At `debug` it also carries the directories and workspace names each request names, and output from the libraries tty7 is built on — worth reading before you attach it to an issue. Capped at 4 MiB. |

src/bin/tty7-updater.rs

@@ -4167,7 +4167,7 @@ mod windows {
 /// This binary runs *detached*, after the GUI it is replacing has exited, so
 /// its stderr is attached to nothing a user will ever read — and it is doing
 /// the one job in the product that can leave an install broken. Without this a
-/// panic mid-swap is simply silence: the app does not come back, `tty7-updater.log`
+/// panic mid-swap is simply silence: the app does not come back, `update.log`
 /// stops mid-sentence, and there is nothing to say why.
 ///
 /// `crash.log` is the same file the app and the server write to, in the config