fix: let the migration hand device.conf to the one place defaults live

classroom-migrate knew how to remove a setting, move a channel and point
a room at the broker, and knew nothing about which settings the classroom
has gained since a room was installed. That list is in
classroom_config.py and it stays there: the migration now hands the file
to ensure_device_config when its own work is done, rather than growing a
second copy of it.

It matters for the command rather than the package. postinst already
called the shared helper before running the migration, so an install
converged; a technician running `sudo classroom-migrate` by hand on an
old machine got a file that was still short of LIVE_ENABLED,
AUDIO_OUTPUT and UI_SCALE. Both paths end in the same place now, and the
release gate runs the command by hand on an already-converged machine to
prove it.

The validator's own expectation was the release-blocking failure, and it
was not what it looked like: it stops at CHANNEL=canary, before it ever
reaches the LIVE_ENABLED count. canary is the sway line, and moving a
migrated room off it is deliberate — a Plasma room left there is handed
the old desktop back by the next release published to it. The fixture now
expects the move, checks that every setting this release has arrived
exactly once, and checks it again after a reinstall.

Co-Authored-By: Claude Opus 5 <[email protected]>

tools/validate-trixie-release.sh

@@ -141,16 +141,46 @@ timeout --signal=TERM --kill-after=5s 45s classroom-provision \
 grep -q 'Elmer is already correctly configured' /tmp/provision-second.log
 
 if [[ -n "$previous" ]]; then
-    grep -q '^CHANNEL=canary$' /etc/ekklesia-classroom/device.conf
+    # The room's own values, untouched by the upgrade.
     grep -q '^DVD_ENABLED=false$' /etc/ekklesia-classroom/device.conf
     grep -q '^UI_SCALE=1.25$' /etc/ekklesia-classroom/device.conf
     grep -q '^MQTT_PASSWORD=preserve-me$' /etc/ekklesia-classroom/device.conf
     grep -q '^CUSTOM_SETTING=preserve-me-too$' /etc/ekklesia-classroom/device.conf
-    [[ "$(grep -c '^LIVE_ENABLED=' /etc/ekklesia-classroom/device.conf)" -eq 1 ]]
+
+    # And the one value the upgrade is supposed to change. canary is the
+    # sway line: a room that has just taken the Plasma package and is left
+    # pointed at it is handed the old desktop back by the next release
+    # there, which is the upgrade undoing itself.
+    grep -q '^CHANNEL=classroom-v2$' /etc/ekklesia-classroom/device.conf
+
+    # Every setting this release has that the room predates, appended
+    # exactly once. classroom-migrate hands device.conf to the shared
+    # helper after its own work for this, so that a machine converges
+    # whether it got here through this postinst or through somebody
+    # running the command by hand.
+    for setting in LIVE_ENABLED AUDIO_OUTPUT UI_SCALE; do
+        [[ "$(grep -c "^${setting}=" /etc/ekklesia-classroom/device.conf)" -eq 1 ]]
+    done
 
     run_logged candidate-reinstall 360 \
         apt-get install --reinstall -y -qq /packages/candidate.deb
-    [[ "$(grep -c '^LIVE_ENABLED=' /etc/ekklesia-classroom/device.conf)" -eq 1 ]]
+
+    # An install that changes nothing must change nothing.
+    for setting in LIVE_ENABLED AUDIO_OUTPUT UI_SCALE; do
+        [[ "$(grep -c "^${setting}=" /etc/ekklesia-classroom/device.conf)" -eq 1 ]]
+    done
+    grep -q '^MQTT_PASSWORD=preserve-me$' /etc/ekklesia-classroom/device.conf
+    grep -q '^CUSTOM_SETTING=preserve-me-too$' /etc/ekklesia-classroom/device.conf
+    grep -q '^CHANNEL=classroom-v2$' /etc/ekklesia-classroom/device.conf
+
+    # And by hand, on a machine that is already converged: the command a
+    # technician runs must be safe to run twice.
+    classroom-migrate >/tmp/migrate-by-hand.log 2>&1
+    for setting in LIVE_ENABLED AUDIO_OUTPUT UI_SCALE; do
+        [[ "$(grep -c "^${setting}=" /etc/ekklesia-classroom/device.conf)" -eq 1 ]]
+    done
+    grep -q '^MQTT_PASSWORD=preserve-me$' /etc/ekklesia-classroom/device.conf
+    ! grep -q 'preserve-me' /tmp/migrate-by-hand.log
 fi
 
 echo "Trixie package, upgrade, bounded install, networking, Elmer printing and reinstall checks passed."