fix: detach update process via systemd-run (v0.3.1)

- Changed backend/update.py to use systemd-run for spawning update/rollback scripts
- Ensures update process survives service restart
- Bumped version to 0.3.1

backend/update.py

@@ -187,8 +187,23 @@ def _run_async(script_path: Path, settings: Settings) -> None:
     env["SKD_UPDATE_TOKEN"] = settings.update_token
     env["SKD_UPDATE_STATUS_FILE"] = settings.update_status_file
     env["SKD_UPDATE_LOG_FILE"] = settings.update_log_file
+
+    # Use systemd-run to detach the update process from the current service unit.
+    # This ensures the script survives 'systemctl stop skd'.
+    # We use --unit to give it a predictable name prefix (though unique suffix is added)
+    # and --scope (or --service) to create a new unit.
+    # Since we need root (and likely run as root), this should work.
+    # Note: --collect ensures garbage collection of the transient unit.
+    cmd = [
+        "systemd-run",
+        "--unit=skd-update",
+        "--collect",
+        "--description=Safe Kiddo Update Process",
+        str(script_path),
+    ]
+
     subprocess.Popen(
-        [str(script_path)],
+        cmd,
         env=env,
         cwd="/",
         stdout=subprocess.DEVNULL,