Self-install into canonical layout on both platforms, --no-copy to opt out

Windows: --install-service creates %ProgramFiles%\gpu-turnstile and
%ProgramData%\gpu-turnstile, copies the exe and (if absent) the env
file in, and registers the copy. Linux: binary goes to
/var/lib/gpu-turnstile (not /usr/local/sbin: replacing a running binary
needs directory write, which must not be granted on a shared system dir
to a sandboxed service). --no-copy registers the current location
as-is on both platforms.

SPEC.md

@@ -169,29 +169,36 @@ The binary runs natively on Windows (the current primary deployment) and on
 Linux with systemd (the future GPU server), as well as in Docker.
 
 Service management is the same on both platforms:
-`gpu-turnstile --install-service [-config path]` registers and starts an
-auto-start service; `--remove-service` stops and unregisters it (both need
-an elevated/root shell). The legacy form `gpu-turnstile service
+`gpu-turnstile --install-service [-config path]` installs, registers and
+starts an auto-start service; `--remove-service` stops and uninstalls it
+(both need an elevated/root shell). The legacy form `gpu-turnstile service
 install|remove` does the same thing.
 
+By default install creates the canonical layout and copies the binary into
+it (Windows: `%ProgramFiles%\gpu-turnstile\`, plus
+`%ProgramData%\gpu-turnstile\` for logs; Linux: `/var/lib/gpu-turnstile/`
+with the config at `/etc/gpu-turnstile.env`). An existing config in the
+target location is never overwritten. `--no-copy` registers the current
+executable location as-is instead.
+
 ### Windows
 
-- `--install-service` registers a Windows service; recovery actions restart
-  it 5 s after any failure.
-- **Layout**: install to `C:\Program Files\gpu-turnstile\` (exe plus
-  `gpu-turnstile.env`); logs belong in `C:\ProgramData\gpu-turnstile\` via
-  `LOG_FILE`.
+- `--install-service` creates `%ProgramFiles%\gpu-turnstile\` and
+  `%ProgramData%\gpu-turnstile\`, copies the exe and (if none exists there
+  yet) the `gpu-turnstile.env` into the Program Files directory, and
+  registers that copy as a Windows service; recovery actions restart it
+  5 s after any failure. Logs go to the ProgramData directory via
+  `LOG_FILE` since there is no console.
 - **Account**: the service always runs as the virtual account
   `NT SERVICE\gpu-turnstile` — a per-service low-privilege identity the
   SCM manages (no password, automatic logon-as-a-service right, no admin
   rights, gone when the service is removed). The installer grants it
-  modify access to the install directory (self-updates rewrite the exe)
-  and the `LOG_FILE` directory (created if missing), plus read access to
-  the config file when it lives elsewhere. The grants happen after service
-  registration because the virtual account's SID only exists from that
-  point on; if a grant fails the service registration is rolled back.
-- Use a config file (above) for the service — Windows services have no
-  convenient environment. Logs go to `LOG_FILE` since there is no console.
+  modify access to the install and data directories (self-updates rewrite
+  the exe) and the `LOG_FILE` directory (created if missing), plus read
+  access to the config file when it lives elsewhere. The grants happen
+  after service registration because the virtual account's SID only exists
+  from that point on; if a grant fails the service registration is rolled
+  back.
 
 ### Linux (systemd)
 
@@ -199,7 +206,12 @@ install|remove` does the same thing.
   copies the config to `/etc/gpu-turnstile.env` if none exists there yet,
   writes `/etc/systemd/system/gpu-turnstile.service`, then runs `systemctl
   daemon-reload` and `enable --now`. `--remove-service` removes the unit
-  and the installed binary; the `/etc` config stays.
+  and the installed binary; the `/etc` config stays. The binary does not
+  go to `/usr/local/sbin` on purpose: replacing a running binary needs
+  write access to its *directory*, and granting the sandboxed service
+  write access to a shared system directory would let a compromised
+  service overwrite other binaries — `/var/lib/gpu-turnstile` is
+  exclusively ours.
 - **Sandboxing** mirrors the Windows virtual account: the unit runs with
   `DynamicUser=yes` — a transient per-service UID with no login, no home
   and no password, managed entirely by systemd. `ProtectSystem=strict`