Record a heartbeat so a silent update checker is distinguishable from a dead one

There was no way to tell "running, nothing to pull" from "not running". The
no-change path logs nothing by design, and PM2 reports a cron-restart process
as `stopped` with ↺ 0 even while firing on schedule — I verified that against
PM2 7.0.4: a one-minute cron fired four times without the counter moving once.

scripts/.last-check is now rewritten on every run with the outcome. It is a
single overwritten line, so it needs no trimming.

The outcome is set by each exit path and written once in `finally`, rather than
calling record at each return — the first version of this did the latter and
already missed the build-failure path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -210,8 +210,23 @@ AutoFirmer, and restarts the clicker if anything under `clicker/` changed.
 **A failed build is never deployed.** The build runs before anything restarts, so
 a broken push leaves the previous build serving and logs the failure instead.
 
-Everything it does is appended to `scripts/update.log`. To see what it would do
-without touching anything:
+### Checking it is alive
+
+`scripts/.last-check` is rewritten on every check, whether or not anything came
+down:
+
+```
+2026-08-31T00:43:27.155Z  up to date at 27a61fd2
+```
+
+This exists because the alternatives mislead. `update.log` only records real
+events, so it stays empty for days when nothing is pushed — and PM2 reports a
+cron-restart process as `stopped` with a restart count of `0` even while it is
+firing on schedule. Neither is evidence of a problem; `.last-check` is the
+signal to trust.
+
+Everything that actually happens is appended to `scripts/update.log`. To see
+what it would do without touching anything:
 
 ```powershell
 node scripts\update-check.mjs --dry-run