fix: an update reboots the computer only once nobody is using it

The update check has been daily at 03:00, Persistent, since 0.1.5 — the
lab's installed stable machine logged it at 03:01 and 03:04 on successive
days — and it stays so. What changes is the reboot after an update. It
happened the moment the update was installed: harmless at 03:00, and a
room restarting itself mid-morning when a computer switched off at 03:00
caught up after being switched on.

Now the updater installs, with every check it had (the device's own
channel, a newer version, the manifest's SHA-256, name and version), and
starts classroom-reboot-when-idle, which reboots once no input device has
produced an event for 30 minutes and no sound card has played for as
long. At 03:00 that is about 03:30; switched off first, the next start is
on the new version. The service has no [Install] and nothing enables it.

The release gate checks after every install and upgrade that the timer is
enabled, daily at 03:00, Persistent, with no boot or repeat trigger and
no drop-in, and that the updater no longer reboots by itself.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/ekklesia-classroom-update

@@ -14,6 +14,7 @@ from urllib.parse import urljoin
 
 CONFIG = "/etc/ekklesia-classroom/device.conf"
 LOCKFILE = "/run/ekklesia-classroom-update.lock"
+REBOOT_WHEN_IDLE = "ekklesia-classroom-reboot-when-idle.service"
 CACHE_DIR = "/var/cache/ekklesia-classroom"
 PACKAGE = "ekklesia-classroom"
 
@@ -291,8 +292,12 @@ def main():
             if args.no_reboot:
                 log("Update requires reboot, but --no-reboot was specified.")
             else:
-                log("Update requires reboot. Rebooting now.")
-                subprocess.run(["systemctl", "reboot"])
+                # Not now. At 03:00 nobody is there; after a missed 03:00,
+                # checked when the computer is next switched on, somebody
+                # usually is. classroom-reboot-when-idle waits until nobody
+                # has touched it for half an hour and nothing is playing.
+                log("Update requires reboot. Rebooting once nobody is using this computer.")
+                subprocess.run(["systemctl", "start", "--no-block", REBOOT_WHEN_IDLE])
 
         return 0