os update: a failed switch undo keeps the trial marker

[onel]

Greptile found this on the 0.16.0 release PR (#583, comment 4195158466). When an os-switch job stops after mark-active other and then cannot put the booted slot first again, it still removed the new slot's trial marker. The new slot could then boot next with no trial, so no safety net and no revert.

Now the marker goes only after the booted slot is first again. If the old slot boots after all, Boot already removes a marker for a switch that never took effect (TestMarkerWithoutActivationIsNoRevert).

• New test TestFailedUndoKeepsTheTrialMarker. It fails without the fix.
• UPDATES.md # 1 and a progress entry, os-switch-undo-marker.md.

Part of #486.

[greptile-apps]

Confidence Score: 5/5

[High risk] Fixes OS update switch undo to preserve trial safety marker.

The PR appears safe to merge; the earlier trial-boot test gap is closed.

What we checked:

• Trial boot without a marker: No. The reboot harness clears earlier marks. Without the marker, Boot marks B good, so the test cannot see the bad mark it requires.

_{Reviews (2) · Last reviewed commit: "fixup: the test boots slot B and wants a..."}