fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

packaging/debian/postinst

@@ -8,13 +8,6 @@ if ! id classroom >/dev/null 2>&1; then
         classroom
 fi
 
-# The session is started by SDDM now. An upgrade from a sway-era room has
-# to remove the login shell that used to start it, or the machine has two
-# things trying to own tty1.
-rm -f /home/classroom/.bash_profile
-rm -f /etc/systemd/system/[email protected]/autologin.conf
-rmdir --ignore-fail-on-non-empty \
-    /etc/systemd/system/[email protected] 2>/dev/null || true
 
 # Commands the room's own parts install. Listing them by name went wrong
 # once already, when a command that had been removed was still chmod'ed
@@ -44,6 +37,13 @@ PY
 chown root:classroom /etc/ekklesia-classroom/device.conf 2>/dev/null || true
 chmod 0640 /etc/ekklesia-classroom/device.conf
 
+# Converge a machine that was something else: the old bar and notification
+# daemon stopped and deactivated, the login shell that used to start sway
+# removed, and device.conf moved off settings this package cannot carry
+# out. Runs on every install, does nothing on a machine that is already
+# this classroom.
+/usr/local/bin/classroom-migrate || true
+
 systemctl daemon-reload || true
 
 # The power button stops working immediately rather than at the next