lifecycle: append container journal tail to failed nixos-container update

CLAUDE.md

@@ -185,6 +185,17 @@ read them à la carte.
 In-flight or recent context that hasn't earned a section yet.
 Prune freely.
 
+- **Just landed:** failed `nixos-container update` self-documents.
+  `lifecycle::run` now appends the tail (40 lines) of the target
+  container's own journal to the bail message when an `update`
+  fails. `nixos-container`'s own stderr on a reload-phase failure
+  is terse ("failed to reload container"); the real cause —
+  which unit failed `switch-to-configuration` — lives in the
+  *container* journal. Scoped to `update` (container's still up
+  on the old generation, so `journalctl -M` works); best-effort,
+  appends nothing if the journal can't be read. The manager's
+  `update` tool / rebuild errors now carry the failing-unit
+  detail without a second `get_logs` call.
 - **Just landed:** `hyperhive.westonRdp.enable` option. New
   `nix/templates/weston-rdp.nix` declares a per-agent bool;
   enabling it runs weston with the RDP backend as a systemd