Make startup failures visible

The first sealed-release launch exited 1 with no stdout, no stderr and
nothing in the journal. The catch around startup logged through app.log,
which is pino: it buffers, and setting process.exitCode lets the process
exit before the buffer flushes, so the error was written nowhere.

Under a supervisor that is the worst shape a failure can take. Idunn
reported only "systemd unit ... is not running", the journal held two
systemd lines and nothing else, and the actual cause -- whatever it is --
was destroyed by the logger meant to record it.

Startup failures now also go to stderr directly, which systemd captures
synchronously. Every earlier failure in this deployment printed a stack
trace precisely because it happened before the logger existed; the ones
after it were silent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/index.ts

@@ -34,6 +34,12 @@ try {
   verseTimer.unref?.();
 } catch (error) {
   await privateCommands?.close().catch(() => undefined);
+  // Write to stderr directly as well as through the logger. Pino buffers, and
+  // setting exitCode lets the process exit before that buffer flushes, so a
+  // startup failure logged only through app.log disappears entirely. Under a
+  // supervisor that is the worst possible failure: the unit dies, the journal
+  // holds nothing, and the operator is told only that it is not running.
+  console.error("Heimdall failed to start:", error);
   app.log.error(error);
   process.exitCode = 1;
 }