fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

tools/lab/from-package

@@ -27,9 +27,11 @@ docker exec "$NAME" sh -c "
 state=$(docker exec "$NAME" dpkg-query -W -f='${db:Status-Abbrev}' ekklesia-classroom)
 echo "package state: $state"
 
-# environment.d is read when the user manager starts, so it starts after.
-docker exec "$NAME" systemctl restart [email protected]e
-sleep 4
+# And then the machine is restarted, the way a room takes an update: a
+# new PID 1, a new user manager, SDDM autologging the classroom in. The
+# session environment, the logind drop-in and the user services are all
+# things that are only read at boot.
+"$LAB" reboot
 
 "$LAB" session >/dev/null
 sleep 8
@@ -50,3 +52,8 @@ check "panel restart policy" "$(docker exec -u classroom -e XDG_RUNTIME_DIR=/run
 check "audio policy" "$(docker exec -u classroom -e XDG_RUNTIME_DIR=/run/user/1000 \
     -e DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus "$NAME" \
     systemctl --user is-active ekklesia-classroom-audio.service || true)"
+
+# The same list of properties the upgraded machine has to satisfy. A
+# fresh install and a migrated one are supposed to be indistinguishable
+# from a teacher's chair, so they are asked the same questions.
+"$ROOT/tools/lab/converged-check" ${CHECK_ARGS:-}