feat: provision Chrome and DVD codecs without a manual step

A fresh classroom needed two things installed by hand on every box:
Google Chrome, which is not in Debian, and the DVD codecs, which Debian
cannot ship. Both now happen on their own.

ekklesia-classroom-provision.service runs after every boot and does the
work that needs the network and the apt lock, neither of which a package
postinst can have. Each step returns immediately if it is already done,
so a provisioned machine costs nothing and a machine that was offline
the first time gets another go at the next boot. Nothing there is
allowed to fail the boot: a classroom with no DVD codecs is still a
working classroom, and it says so in the log rather than silently.

The postinst enables the service but deliberately does not start it.
Every OTA update reboots the moment the install finishes, and an apt run
killed by that reboot would leave dpkg half-configured.

Chrome comes from Google's own repository rather than a one-off .deb, so
it keeps getting security updates. Google's package migrates whatever we
write into a deb822 file of its own, so the repository is looked for
across every source file instead of only the one we would write;
otherwise a machine that had Chrome removed would end up with two copies
of the same repository.

The DVD codec helper previously assumed deb822 sources and did nothing
on a machine using a classic /etc/apt/sources.list, which is what the
hardware actually runs. It now handles both formats, and only ever adds
a missing component to an existing Debian entry — so it cannot produce a
duplicate repository or a duplicate component however many times it
runs, and third-party repositories like Chrome's are never touched. It
also answers libdvd-pkg's debconf questions, so nothing blocks on a
prompt in a service with no terminal.

Tested against fixture APT trees for classic sources.list, deb822
.sources, contrib already enabled, repeated runs, third-party
repositories and the awkward real lines: bracketed options, indentation,
trailing comments and flat repositories.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/provisioning.md

@@ -0,0 +1,58 @@
+# Provisioning
+
+Some things a classroom needs cannot be installed by the classroom
+package itself: they need the network, and they need the apt lock that
+dpkg is holding for the whole of the package's `postinst`.
+
+`ekklesia-classroom-provision.service` runs after every boot and does
+them. It is a `oneshot` unit that nothing else waits on, so it never
+holds the classroom up, and **it is not allowed to fail the boot**: a
+machine with no DVD codecs is still a working classroom.
+
+The package `postinst` enables the service but deliberately does not
+start it. Every OTA update reboots the moment the install finishes, and
+an apt run killed by that reboot would leave dpkg half-configured. The
+next boot is a few seconds away and is a clean place to work.
+
+To provision without waiting for a reboot:
+
+```
+sudo classroom-provision
+```
+
+Each step checks whether it is already done and returns immediately if
+so. A provisioned machine costs nothing; a machine that was offline the
+first time gets another go at the next boot.
+
+```
+journalctl -u ekklesia-classroom-provision
+```
+
+## Google Chrome
+
+Chrome is not in Debian and a classroom is not usable without it, so a
+fresh machine installs it itself rather than waiting for someone to do it
+by hand on every box.
+
+`classroom-chrome-setup` adds Google's signing key to
+`/etc/apt/keyrings/google-chrome.gpg` and their repository to
+`/etc/apt/sources.list.d/google-chrome.list` — the same path Google's own
+package manages, so the two cannot become two copies of the same
+repository — then installs `google-chrome-stable`. Using the repository
+rather than a one-off `.deb` means Chrome keeps getting security updates.
+
+Run it by hand with `sudo classroom-chrome-setup`. It returns
+immediately if Chrome is already installed.
+
+The Chrome policies in `/etc/opt/chrome/policies/` are shipped by the
+classroom package and apply as soon as Chrome exists.
+
+## DVD codecs
+
+Only for rooms with `DVD_ENABLED=true`. See [dvd.md](dvd.md).
+
+## What provisioning does not do
+
+It never upgrades or reconfigures anything already installed, and it
+never touches a repository it did not add. Classroom software updates
+are the OTA channel's job, not this.

docs/testing.md

@@ -11,6 +11,14 @@ before promoting to stable with `./update_stable.sh`.
 - [ ] Dock appears, centred
 - [ ] Clock appears, bottom right
 
+## Provisioning
+
+- [ ] `journalctl -u ekklesia-classroom-provision` shows a clean run
+- [ ] Google Chrome is installed on a machine that never had it
+- [ ] A second boot does not reinstall anything
+- [ ] A machine with no network still boots to a working shell, and
+      provisioning succeeds at a later boot once it is online
+
 ## UI scale
 
 - [ ] `UI_SCALE=1.0` looks exactly as it did before scaling existed
@@ -114,7 +122,8 @@ With `DVD_ENABLED=true`:
 - [ ] VLC opens fullscreen, dark, with no menu bar, no orange cone and
       no sway title bar
 - [ ] The fullscreen controller still appears on mouse movement
-- [ ] Commercial CSS disc, after `classroom-dvd-css-setup`
+- [ ] Commercial CSS disc plays without anyone having run codec setup
+      by hand
 
 ## OTA