--install-service now registers the service under NT SERVICE\gpu-turnstile (low-privilege, per-service, no password) and grants it modify access to the install dir (for self-updates) and the LOG_FILE dir, plus read access to an external config file. Grants run after CreateService because the virtual account's SID does not exist before registration; a failed grant rolls back the registration.