fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

tools/lab/install-desktop

@@ -12,16 +12,26 @@ SRC="${1:-/srv/classroom}"
 # A directory of the classroom's own, ahead of /etc/xdg in
 # XDG_CONFIG_DIRS. plasma-workspace owns files by these names in /etc/xdg
 # and two packages cannot own one path.
-for setting in kdeglobals kwinrc kwinrulesrc kscreenlockerrc ksmserverrc \
+for setting in kwinrc kwinrulesrc kscreenlockerrc ksmserverrc \
         krunnerrc plasmanotifyrc powermanagementprofilesrc; do
     install -Dm644 "$SRC/config/plasma/xdg/$setting" \
         "/etc/ekklesia-classroom/xdg/$setting"
     rm -f "/etc/xdg/$setting.ekklesia-old"
 done
 
+# Composed, not copied — the policy and the palette. See tools/build-kdeglobals.
+install -d /etc/ekklesia-classroom/xdg
+"$SRC/tools/build-kdeglobals" > /etc/ekklesia-classroom/xdg/kdeglobals
+chmod 0644 /etc/ekklesia-classroom/xdg/kdeglobals
+
 install -Dm644 "$SRC/config/environment/90-ekklesia-classroom.conf" \
     /etc/environment.d/90-ekklesia-classroom.conf
 
+# What actually puts that directory into a session started by a display
+# manager. startplasma sources this; PAM never reads environment.d.
+install -Dm644 "$SRC/config/plasma/env/zz-ekklesia-classroom.sh" \
+    /etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh
+
 install -Dm644 "$SRC/config/systemd/logind-ekklesia-classroom.conf" \
     /etc/systemd/logind.conf.d/ekklesia-classroom.conf
 
@@ -53,6 +63,9 @@ done
 install -Dm644 "$SRC/config/plasma/solid/ekklesia-dvd.desktop" \
     /usr/share/solid/actions/ekklesia-dvd.desktop
 
+install -Dm644 "$SRC/config/dbus/fr.emersion.mako.service" \
+    /usr/local/share/dbus-1/services/fr.emersion.mako.service
+
 for icon in "$SRC"/config/icons/ekklesia-*.svg; do
     [ -e "$icon" ] || continue
     install -Dm644 "$icon" \