fix: let the migration hand device.conf to the one place defaults live

classroom-migrate knew how to remove a setting, move a channel and point
a room at the broker, and knew nothing about which settings the classroom
has gained since a room was installed. That list is in
classroom_config.py and it stays there: the migration now hands the file
to ensure_device_config when its own work is done, rather than growing a
second copy of it.

It matters for the command rather than the package. postinst already
called the shared helper before running the migration, so an install
converged; a technician running `sudo classroom-migrate` by hand on an
old machine got a file that was still short of LIVE_ENABLED,
AUDIO_OUTPUT and UI_SCALE. Both paths end in the same place now, and the
release gate runs the command by hand on an already-converged machine to
prove it.

The validator's own expectation was the release-blocking failure, and it
was not what it looked like: it stops at CHANNEL=canary, before it ever
reaches the LIVE_ENABLED count. canary is the sway line, and moving a
migrated room off it is deliberate — a Plasma room left there is handed
the old desktop back by the next release published to it. The fixture now
expects the move, checks that every setting this release has arrived
exactly once, and checks it again after a reinstall.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/test-deployment-support.sh

@@ -211,6 +211,18 @@ package_copy = canary.index('cp "$package_path"')
 first_rsync = canary.index("rsync -av")
 check("Trixie validation runs before the repository copy", validation < package_copy)
 check("Trixie validation runs before any upload", validation < first_rsync)
+# The gate checks convergence, not just that the package installs: an
+# upgraded room ends on the v2 channel with every setting this release
+# has, exactly once, and the command a technician runs is safe to run on
+# a machine that is already converged.
+check("the gate checks the upgraded channel",
+      "'^CHANNEL=classroom-v2$'" in validation_script)
+check("and that every new setting arrived exactly once",
+      "for setting in LIVE_ENABLED AUDIO_OUTPUT UI_SCALE" in validation_script)
+check("and that running the migration by hand is safe",
+      "classroom-migrate >/tmp/migrate-by-hand.log" in validation_script)
+check("and that it never prints the broker password",
+      "! grep -q 'preserve-me' /tmp/migrate-by-hand.log" in validation_script)
 
 print()
 print("7. one scale, applied everywhere")