feat(doorman): honor local_unlock flag from break-glass scans [#345]

Break-glass badges fire the relay locally on the reader host (no HA
dependency); the flagged scan still reaches HA for the audit trail
but skips re-dispatch. NOTE: deployed while pfv-bms is down — YAML
lint clean, ha core check to run at Friday boot before arming.

https://projects.knownelement.com/issues/345

packages/doorman.yaml

@@ -155,8 +155,10 @@ automation:
                     checked: roster sensors are not populated. Logged
                     only; whitelist NOT evaluated. Check gitea
                     connectivity / KNEL/access-roster.
-          # Known + enabled badge: log, then dispatch unlock IF armed
+          # Known + enabled badge: log, then dispatch unlock IF armed AND
-          # (founder-level input_boolean). Disarmed = log + notice only.
+          # the listener didn't already handle it locally (break-glass
+          # scans carry local_unlock:true — relay already fired on the
+          # reader host; HA logs without re-dispatching).
           - conditions: "{{ is_known and is_enabled }}"
             sequence:
               - action: logbook.log
@@ -166,9 +168,10 @@ automation:
                     Badge {{ badge_id }} ({{ holder }}) accepted at
                     {{ reader }}.
               - if:
-                  - condition: state
+                  - condition: template
-                    entity_id: input_boolean.doorman_unlock_enabled
+                    value_template: >-
-                    state: 'on'
+                      {{ is_state('input_boolean.doorman_unlock_enabled', 'on')
+                         and not (trigger.json.local_unlock | default(false) | bool(false)) }}
                 then:
                   - action: rest_command.doorman_unlock
                     continue_on_error: true
@@ -181,10 +184,11 @@ automation:
                       title: Doorman — badge accepted, UNLOCK dispatched
                       message: "{{ holder }} scanned at {{ reader }} ({{ scanned }}). Door released for the hold window."
                 else:
-                  - action: persistent_notification.create
+                  - action: logbook.log
                     data:
-                      title: Doorman — badge accepted, unlock NOT armed
+                      name: Doorman
-                      message: "{{ holder }} scanned at {{ reader }} ({{ scanned }}). Unlock is disarmed — door stayed shut."
+                      message: >-
+                        No HA dispatch — {{ 'already released locally via break-glass' if trigger.json.local_unlock | default(false) | bool(false) else 'unlock disarmed' }}.
           # In roster but disabled: flag it loudly (stolen/suspended
           # badge use is exactly what we want to know about).
           - conditions: "{{ is_known and not is_enabled }}"