fix: let the migration hand device.conf to the one place defaults live

classroom-migrate knew how to remove a setting, move a channel and point
a room at the broker, and knew nothing about which settings the classroom
has gained since a room was installed. That list is in
classroom_config.py and it stays there: the migration now hands the file
to ensure_device_config when its own work is done, rather than growing a
second copy of it.

It matters for the command rather than the package. postinst already
called the shared helper before running the migration, so an install
converged; a technician running `sudo classroom-migrate` by hand on an
old machine got a file that was still short of LIVE_ENABLED,
AUDIO_OUTPUT and UI_SCALE. Both paths end in the same place now, and the
release gate runs the command by hand on an already-converged machine to
prove it.

The validator's own expectation was the release-blocking failure, and it
was not what it looked like: it stops at CHANNEL=canary, before it ever
reaches the LIVE_ENABLED count. canary is the sway line, and moving a
migrated room off it is deliberate — a Plasma room left there is handed
the old desktop back by the next release published to it. The fixture now
expects the move, checks that every setting this release has arrived
exactly once, and checks it again after a reinstall.

Co-Authored-By: Claude Opus 5 <[email protected]>

scripts/classroom-migrate

@@ -25,6 +25,15 @@ set -uo pipefail
 CLASSROOM_USER=classroom
 DEVICE_CONFIG=/etc/ekklesia-classroom/device.conf
 
+# The classroom's own Python, wherever this is being run from: the package
+# path first, and the checkout next to this script when there is no
+# package — which is how the tests reach it.
+LIB_DIR=/usr/local/lib/ekklesia-classroom
+
+if [[ ! -r "$LIB_DIR/classroom_config.py" ]]; then
+    LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" 2>/dev/null && pwd || true)"
+fi
+
 # The shells this appliance replaces. There is exactly one desktop stack
 # now — SDDM, KWin, plasmashell — and every one of these is a component of
 # a stack that is gone.
@@ -260,6 +269,39 @@ if changed:
 PY
 fi
 
+# --------------------------------------------- and then the shared defaults
+
+# Everything above is this package's own business: settings to remove, a
+# channel to move, a broker to point at. What it deliberately does not do
+# is know which settings the classroom has gained since a room was
+# installed. That list lives in classroom_config.py, in one place, and
+# ensure_device_config appends exactly the ones a file is missing and
+# nothing else — so a room upgraded from any age ends up with all of them,
+# whether it arrived here through the package's postinst or through
+# somebody running this command by hand. Repeating the list here would
+# mean two places to forget.
+#
+# It runs last on purpose. The migration above rewrites lines; this only
+# ever appends, so appending afterwards cannot be undone by it.
+#
+# Outside the guard the migration is inside, because this also writes a
+# device.conf for a machine that has none.
+if [[ -n "$LIB_DIR" && -r "$LIB_DIR/classroom_config.py" ]]; then
+    if ! PYTHONPATH="$LIB_DIR" python3 - "$DEVICE_CONFIG" <<'SHARED'
+import sys
+
+from classroom_config import ensure_device_config
+
+ensure_device_config(sys.argv[1])
+SHARED
+    then
+        say "WARNING: could not add this release's settings to device.conf"
+    fi
+else
+    say "WARNING: classroom_config.py is missing, so device.conf may be short"
+    say "         of settings this release added"
+fi
+
 # ------------------------------------------------------- the old session
 
 # Plasma reads the classroom's settings out of a directory that has to be