fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/test-deployment-support.sh

@@ -99,7 +99,15 @@ print("4b2. the session settings do not fight another package")
 # live in a directory of their own, in front of /etc/xdg.
 check("settings install to the classroom's own directory",
       "$STAGE/etc/ekklesia-classroom/xdg/" in build)
-check("nothing is installed into /etc/xdg", "$STAGE/etc/xdg/" not in build)
+# One file of ours does live under /etc/xdg, and it is not a settings
+# file: it is the session environment drop-in that puts the directory
+# above into the cascade at all. A drop-in directory is built to be
+# added to; a name plasma-workspace already owns is not.
+xdg_paths = re.findall(r'\$STAGE(/etc/xdg/[^"]+)', build)
+check("the only file under /etc/xdg is the session env drop-in",
+      xdg_paths == ["/etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh"])
+check("no settings file takes a name plasma-workspace owns",
+      not any(path.rsplit("/", 1)[0] == "/etc/xdg" for path in xdg_paths))
 check("and that directory is searched first",
       "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg" in
       (root / "config/environment/90-ekklesia-classroom.conf").read_text())
@@ -132,8 +140,15 @@ check("PowerDevil: no action on the power button",
       power.count("powerButtonAction=0") == 3)
 check("PowerDevil: no action on a lid either",
       power.count("lidAction=0") == 3)
+# Six: the three button groups, and the three profiles around them.
+# PowerDevil loads an idle action when it finds a group for it, so a
+# writable profile is one a leftover user file can add a suspend to.
 check("and the session cannot put an action back",
-      power.count("[$i]") == 3)
+      power.count("[$i]") == 6)
+check("no idle action in any profile",
+      not any(f"[{profile}][{action}]" in power
+              for profile in ("AC", "Battery", "LowBattery")
+              for action in ("SuspendSession", "DimDisplay", "DPMSControl")))
 check("the logind drop-in is packaged",
       "/etc/systemd/logind.conf.d/ekklesia-classroom.conf" in build)
 check("the PowerDevil profile is packaged",