fix: put the popup close button in the dock, and clear the printer location

Three things, none of them redesigns.

The close affordance for a secondary Chrome window was a separate
layer-shell surface anchored to that window's corner, repositioned by a
five-per-second poll. Any position change tore the surface down and
built another, so on real hardware it chased the window and flickered.
Removed entirely: the GTK button process, the geometry maths that placed
it, the --close-button mode that spawned it, and the poll loop that
drove it. The window helper no longer imports GTK at all.

The behaviour underneath it was right and is kept. The first Chrome
top-level is the classroom browser, tiled and borderless; later ones
float centred at about three quarters of the output. Creation order is
the only thing that can tell them apart — confirmed on a real session,
where every Chrome top-level shares app_id, shell, PID and a null
transient_for, and sway exposes no window properties for Wayland
toplevels at all. Titles are still not used. It now follows sway's own
window events instead of polling, so dragging a popup costs nothing.

Close moved into the dock, which was already on screen and does not
move, so it cannot chase anything. It appears only while a secondary
window is focused and runs kill on that one container. The helper
publishes which window that is; the dock watches the file rather than
polling. A stock sway title bar has no close button, so restoring the
border would not have solved this either.

Two bugs found by looking rather than by testing state. Chrome
renegotiates the size of a popup opened with explicit dimensions after
the resize returns, which left windows centred for a width they no
longer had; placement now settles and repeats once, at creation only, so
dragging is still free. And the dock's Close button came up empty
because show_all does not recurse into a no-show-all widget.

The printer's Location is now blank. CUPS prints it under the queue name
in every dialog, so "Ekklesia Classroom" was a second line the teacher
had to read past; the identity is one word. The already-configured check
includes Location, so a machine set up before this is corrected rather
than left as close enough.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/provisioning.md

@@ -9,10 +9,10 @@ them. It is a `oneshot` unit that nothing else waits on, so it never
 holds the classroom up, and **it is not allowed to fail the boot**: a
 machine with no DVD codecs is still a working classroom.
 
-The package `postinst` enables the service but deliberately does not
-start it. Every OTA update reboots the moment the install finishes, and
-an apt run killed by that reboot would leave dpkg half-configured. The
-next boot is a few seconds away and is a clean place to work.
+The package `postinst` enables the service and schedules a delayed start after
+the outer apt transaction has had time to release its lock. It never runs
+provisioning synchronously inside dpkg. If an OTA reboot happens before the
+delayed job, the enabled service runs normally on the next boot.
 
 To provision without waiting for a reboot:
 
@@ -60,6 +60,11 @@ requires Internet access or hardware to be present.
 - Wi-Fi administration: [networking.md](networking.md)
 - Church color printer setup: [printing.md](printing.md)
 
+The printer helper is part of every provisioning pass. It is capped at 30
+seconds and only configures the local scheduler, so an offline Ricoh cannot
+hold boot or provisioning open. Failures are logged and retried on the next
+boot. A correctly configured queue is a quick no-op.
+
 ## What provisioning does not do
 
 The boot provisioning command never upgrades or reconfigures anything already installed, and it