fix(kiosk): stop GDM covering the wall with a greeter after auto-login

Auto-login succeeded and the wall kept streaming, but about ten seconds
after the kiosk session came up GDM autospawned a greeter on the same GPU
and a login screen covered it. gnome-kiosk ships X-GDM-SessionRegisters=false,
so nothing ever registers and GDM concludes the display is still free — which
is why every remote check (loginctl, the mirror roster) stayed green while
the physical screen showed a password prompt.

Override that session file with the flag set to true, keeping the file name
and session id identical: inventing an id makes GDM quietly fall back to the
plain GNOME session, top bar and all.

Add a per-minute guard that reclaims the foreground VT, because this class
of failure is invisible from the outside, and have the checker assert both
the foreground VT and the greeter-session count. That count had a silent
false green: journalctl has no --no-legend, so the check read an empty
stream and passed unconditionally.

Also keep a copy of the payload in /usr/local/share/mirror-kiosk. /tmp is
cleared at every boot, which deletes the checker just after the one event
you are most likely to want to re-run it for.

Verified on the reference client: a cold boot now creates no greeter session
at all, the kiosk compositor and Firefox come up undisturbed, and a console
stolen with chvt is taken back within a minute.

LLM-Generated: true

docs/kiosk-silverblue/check-kiosk.sh

@@ -75,6 +75,13 @@ if [ -n "$HOME_DIR" ]; then
 fi
 check_file /etc/firefox/policies/policies.json "DisableAppUpdate" "firefox policy"
 check_file /usr/local/share/gnome-kiosk/window-config.ini "org.mozilla" "kiosk window rules"
+# Without this key the shipped gnome-kiosk session never registers with GDM and
+# GDM autospawns a greeter over the wall ~8s after auto-login. The single most
+# confusing failure this setup has: the kiosk keeps running underneath, so the
+# mirror roster and loginctl both still look perfect while the screen shows a
+# login prompt.
+check_file /usr/local/share/wayland-sessions/gnome-kiosk-script-wayland.desktop \
+    "X-GDM-SessionRegisters=true" "GDM session override"
 
 printf '\n%s\n' '--- session wiring ---'
 ACCT="/var/lib/AccountsService/users/$KIOSK_USER"
@@ -103,7 +110,34 @@ else
 fi
 SEAT_SESSION=$(loginctl list-sessions --no-legend 2>/dev/null | awk '$4=="seat0"{print $1; exit}')
 if [ -n "$SEAT_SESSION" ]; then
-    info "seat0 session $SEAT_SESSION: class=$(loginctl show-session "$SEAT_SESSION" -p Class --value 2>/dev/null) type=$(loginctl show-session "$SEAT_SESSION" -p Type --value 2>/dev/null) vt=$(loginctl show-session "$SEAT_SESSION" -p VTHint --value 2>/dev/null)"
+    info "seat0 session $SEAT_SESSION: class=$(loginctl show-session "$SEAT_SESSION" -p Class --value 2>/dev/null) type=$(loginctl show-session "$SEAT_SESSION" -p Type --value 2>/dev/null)"
+fi
+
+# Does the kiosk actually hold the screen? A session can be Active while another
+# one owns the foreground VT, which is what a covered wall looks like from here.
+KIOSK_SESSION=$(loginctl list-sessions --no-legend 2>/dev/null |
+    awk -v u="$KIOSK_USER" '$3==u && $4=="seat0"{print $1; exit}')
+if [ -n "$KIOSK_SESSION" ]; then
+    K_ACTIVE=$(loginctl show-session "$KIOSK_SESSION" -p Active --value 2>/dev/null)
+    K_TTY=$(loginctl show-session "$KIOSK_SESSION" -p TTY --value 2>/dev/null)
+    K_FG=$(sudo cat /sys/class/tty/tty0/active 2>/dev/null)
+    if [ "$K_ACTIVE" = "yes" ] && [ -n "$K_TTY" ] && [ "$K_FG" = "$K_TTY" ]; then
+        ok "the kiosk holds the console (foreground VT $K_FG)"
+    else
+        bad "console is on ${K_FG:-?} but the kiosk is on ${K_TTY:-?} (Active=$K_ACTIVE) — the screen is showing something else"
+        info "fix: sudo loginctl activate $KIOSK_SESSION, then check the session override above"
+    fi
+fi
+
+# Count the greeter *sessions* GDM created this boot, not every mention: a
+# healthy kiosk creates none, and the autospawn bug creates exactly one soon
+# after auto-login. (journalctl has no --no-legend; using it here once made this
+# test read an empty stream and pass unconditionally — a silent false green.)
+GREETERS=$(sudo journalctl -b --no-pager 2>/dev/null |
+    grep -c "New session .* of user 'gdm-greeter'")
+if [ "${GREETERS:-0}" -gt 0 ]; then
+    warn "$GREETERS GDM greeter session(s) this boot: the wall may be covered by a login screen"
+    info "check X-GDM-SessionRegisters=true in /usr/local/share/wayland-sessions/"
 fi
 
 if [ -n "$HOME_DIR" ]; then