Persist the tentacle agent log to a rotated file under the service

[ppXD]

Summary

• The tentacle's Serilog logger wrote to the console only. A Windows-SCM-launched service has no console — writes go to NUL — so the agent's entire runtime log was lost, leaving operators nothing to inspect after a failure. The only Windows-persistent file (the SCM-startup diagnostic) was append-only with no size cap.
• Add a size-rotated Serilog file sink (50 MB × 5 retained files) via a new testable TentacleLogging helper, gated to the managed-service launch (ShouldRunUnderScm). Short-lived CLI commands (version, register, …) stay console-only so they don't litter a log file per invocation. On Linux/systemd the console is already captured by journald, so the sink targets the Windows-service gap specifically. Directory creation is best-effort — a log file can never block the service from starting.
• Bound the separate append-only SCM-startup diagnostic log with a single-generation size rotation (RotateIfOversized, 1 MB → .old).
• Non-breaking / additive: console behaviour (stderr routing, output template) is unchanged; the file sink is purely additive and only active for the running service. Adds the Serilog.Sinks.File package.

Test plan

• Unit: operator-visible constants pinned (50 MB / 5 files / tentacle.log / logs / 1 MB SCM cap); ResolveAgentLogPath under {system-config-dir}/logs
• Unit: file-sink off → no file written (CLI path); file-sink on → persistent log written + contains the message
• Unit: real rolling-file rotation proven (tiny size override → multiple rolled files, capped at the retained-count limit)
• Unit: RotateIfOversized under-limit no-op / over-limit → .old + truncate / missing-file no-throw
• Regression: Squid.Tentacle.Tests Core/Entry/Scm 102/102 green; full suite green except 5 disk-gated RunningScriptReporterTests that fail on a near-full dev disk (DiskSpaceChecker 10% floor — environmental, branch-independent, untouched by this change; passes on CI)
• dotnet build Squid.sln 0 errors