perf: keep file I/O off Service.mu and untie StartOnly from the app context

Phase 7 of the whole-project review (findings 3.2 and 3.3).

Service.mu is the lock the Fyne main thread takes on every Jobs() and
Runtime() call, so anything blocking inside it makes a UI refresh wait on
the disk. Three things did:

- Every SaveJobs/SaveConfig was a marshal, fsync, and rename under mu.
  Writes are now prepared under the lock (Store.PrepareSaveJobs /
  PrepareSaveConfig snapshot the payload and target path) and run after
  it is released. deferSaveLocked takes saveMu while mu is still held, so
  writes still reach the file in the order their snapshots were taken and
  an older snapshot can never land on top of a newer one.
- executeRun ran runner.CleanupLogs under mu after every run. It needs
  only the values already snapshotted into runEnv, so it now runs after
  the unlock — including when the job is gone, since the run still wrote
  a log file that retention covers.
- adoptJobsLocked ran runner.SeedStats under mu, reached from
  UpdateSettings on the UI thread. Seeding moved out into
  applySeededStatsLocked; UpdateSettings now reads the new jobs file and
  seeds its statistics before taking the lock, and re-checks the
  "no jobs-file switch while running" guard once it has it.

SeedStats also opened every log file twice — once to find the job, again
to read the result. readLogSummary reads job_id, state, and duration in
one pass, so each log is opened once.

StartOnly runs were built with exec.CommandContext on the app's lifecycle
context. os/exec keeps a watcher goroutine alive until Wait returns or the
context is done, and StartOnly never calls Wait, so one goroutine leaked
per run and would then try to kill a process whose handle startJobOnly had
already released. The invocation now uses context.Background(), whose nil
Done channel means no watcher is started at all.

Regression tests: TestRunJobStartOnlyLeavesNoContextWatcher (fails with 5
leaked goroutines on the old code), TestConcurrentJobOperationsLeaveTheFileMatchingMemory,
and TestUpdateSettingsSeedsAdoptedJobsFromLogs. STANDARDS gains the
no-I/O-under-mu rule and the "a StartOnly process outlives GoSentry" entry.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/runner/runner_test.go

@@ -401,6 +401,58 @@ func TestRunJobZeroTimeoutMeansNoTimeout(t *testing.T) {
 	}
 }
 
+// A StartOnly run must not leave a watcher goroutine behind. exec.CommandContext
+// keeps one alive until Wait returns or the context is done, and StartOnly never
+// waits, so binding it to the caller's cancelable context would leak one
+// goroutine per run for the lifetime of the app — and then, on shutdown, kill a
+// process whose handle startJobOnly has already released.
+func TestRunJobStartOnlyLeavesNoContextWatcher(t *testing.T) {
+	command := "sh"
+	arguments := "-c\nexit 0"
+	if runtime.GOOS == "windows" {
+		command = `C:\Windows\System32\cmd.exe`
+		arguments = "/C\nexit /b 0"
+	}
+	job := domain.Job{
+		ID:        53,
+		Name:      "Start Only Goroutines",
+		Command:   command,
+		Arguments: arguments,
+		StartOnly: true,
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	const runs = 5
+	before := settledGoroutines()
+	for i := 0; i < runs; i++ {
+		if _, err := RunJob(ctx, &job, "Manual", t.TempDir(), 30*time.Second); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Counted before cancel on purpose: a watcher would still be parked on
+	// ctx.Done() at this point, and cancelling first would release it.
+	if leaked := settledGoroutines() - before; leaked > 1 {
+		t.Errorf("%d goroutines left after %d StartOnly runs, want none tied to the run context", leaked, runs)
+	}
+}
+
+// settledGoroutines returns the goroutine count once it has stopped falling, so
+// a goroutine that is still on its way out is not mistaken for a leak.
+func settledGoroutines() int {
+	lowest := runtime.NumGoroutine()
+	for stable, i := 0, 0; stable < 3 && i < 100; i++ {
+		time.Sleep(10 * time.Millisecond)
+		if count := runtime.NumGoroutine(); count < lowest {
+			lowest, stable = count, 0
+			continue
+		}
+		stable++
+	}
+	return lowest
+}
+
 func TestRunJobStartOnlyIgnoresTimeout(t *testing.T) {
 	command := "sh"
 	arguments := "-c\nsleep 5"