sddm autologin disabled by ruling (#611)

The always-alive console session held the user's single plasmashell and
black-screened RDP. Live conf removed, staged/apply-guest.sh step now
removes it instead of writing it, REBUILD KDE policy updated. Console
shows the greeter at boot; RDP is the primary desktop; Sunshine will
get a kiosk account or XFCE when it lands.

Details: https://projects.knownelement.com/issues/611

REBUILD.md

@@ -45,9 +45,11 @@ up after host boot (gateway auto-recovers).
 - Mount the data disks per `docs/state/guest-system.txt` FSTAB section:
   `/data1` (SSD 200G) and `/data2` (ssd2 400G), ext4 `noatime`.
 - Hostname `ultix-streaming`; ssh enabled.
-- KDE policy (2026-08-31 ruling): autologin into an UNLOCKED
-  always-alive session (sddm Relogin=true, autolock OFF) — applied by
-  `fix-kde.sh` in this repo.
+- KDE policy (2026-09-01 ruling, supersedes 08-31): **NO sddm autologin**
+  — an always-alive console session holds the user's single plasmashell
+  and black-screens RDP (Plasma 6 = one shell per user, #611). Console
+  shows the sddm greeter at boot; RDP is the primary desktop. When
+  Sunshine lands with the GPU it gets a dedicated kiosk account or XFCE.
 
 ## 2. Accounts + secrets + tools