fix: a notification's Configure button no longer opens system settings

The kernel memory killer's "Memory Shortage Avoided" notice carried a
Configure button that ran kcmshell6 and opened KDE's whole Notifications
settings under the teacher's account. Reproduced in the lab.

Plasma draws that button without consulting the Kiosk policy, but
kcmshell6 and System Settings do: every settings module Debian 13's
Plasma 6.3 installs (90) is now refused in the classroom's immutable
kdeglobals, so the same click shows only "disabled by the system
administrator". The clock's Configure Digital Clock goes with
plasma/allow_configure_when_locked=false; Configure Audio Devices
disappears on its own; the disabled window's Help button opened KDE Help
Center, which the package now conflicts with (plasma-desktop only
recommends it).

The maintenance terminal runs outside the classroom's configuration and
still opens every module, verified. converged-check fails if any module
on a machine is ever left unrestricted: 126 passed in the lab.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/kiosk.md

@@ -116,3 +116,45 @@ and nothing needs reinstalling.
 To put the session screen back, remove the D-Bus shadow and the
 `kglobalshortcutsrc` entries; both are package files, so an update will
 restore them, which is the intended direction.
+
+## Settings the teacher must not reach (0.2.6.2)
+
+During testing the kernel's memory killer raised Plasma's *Memory Shortage
+Avoided* notice, and its **Configure** button opened KDE's Notifications
+settings under the teacher's account — every application and system
+service, with Apply. Reproduced in the lab: the button runs
+`kcmshell6 notifications`.
+
+Plasma draws that button on any notification whose application has KDE
+notification settings, without asking the Kiosk policy. What does ask is
+the thing it launches: `kcmshell6` and System Settings refuse a module
+listed under `[KDE Control Module Restrictions]`. KDE has no wildcard for
+that group, so **every settings module Debian 13's Plasma 6.3 installs —
+90, found on the lab machine — is listed**, immutable, in the classroom's
+`kdeglobals`. Measured afterwards:
+
+| Entry point | Before | After |
+| --- | --- | --- |
+| A notification's Configure button | Notifications settings, editable | *The module kcm_notifications is disabled … by the system administrator* |
+| That window's **Help** button | KDE Help Center: menus, man pages, file dialogs | not installed (`Conflicts: khelpcenter`; plasma-desktop only recommends it) |
+| Volume: right-click | *Configure Audio Devices…* | entry gone — the applet asks the policy |
+| Clock: right-click | *Adjust Date and Time…*, *Configure Digital Clock…* | *Configure* gone (`plasma/allow_configure_when_locked=false`); *Adjust* opens a System Settings with nothing in it |
+| Bell, empty panel: right-click | no menu | no menu |
+| Network | already refused (0.2.4) | unchanged |
+
+The button itself still shows on such a notification, and still opens the
+small "disabled" window: hiding it would mean replacing Plasma's
+notification applet, which is exactly what this appliance does not do.
+Notifications themselves are untouched — Parent Call, the room's
+messages, Wonder Ink's "Sent to the printer" all still appear.
+
+**The maintenance route is unaffected.** `classroom-admin-terminal` starts
+Konsole with `XDG_CONFIG_DIRS=/etc/xdg`, outside this file, so anything a
+technician starts from it — `systemsettings`, `kcmshell6 kcm_notifications`
+— is the whole of it. Verified in the lab: the same module refused to the
+teacher opened fully, editable, from the maintenance terminal.
+
+`tools/lab/converged-check` fails if any settings module on the machine is
+not refused in the classroom's cascade, so a Plasma update that adds one
+cannot quietly reopen this; and it checks the maintenance cascade still
+refuses nothing.