sddm autologin disabled by ruling (#611)

The always-alive console session held the user's single plasmashell and
black-screened RDP. Live conf removed, staged/apply-guest.sh step now
removes it instead of writing it, REBUILD KDE policy updated. Console
shows the greeter at boot; RDP is the primary desktop; Sunshine will
get a kiosk account or XFCE when it lands.

Details: https://projects.knownelement.com/issues/611

staged/apply-guest.sh

@@ -95,17 +95,14 @@ step_daemonjson() {
   say "docker restarted with new config; check: docker info | grep -E 'Live|Logging'"
 }
 step_desktop() {
-  [ "$CONFIRM" = 1 ] || die "desktop needs CONFIRM=1: enables sddm autologin for $DESKTOP_USER"
-  gate "configure sddm autologin+lock" || return 0
-  mkdir -p /etc/sddm.conf.d
-  cat > /etc/sddm.conf.d/50-ukrrs-autologin.conf <<EOF
-[Autologin]
-User=$DESKTOP_USER
-Session=plasma.desktop
-Relogin=true
-EOF
-  say "sddm autologin configured (UNLOCKED session; autolock deliberately off"
-  say "per 2026-08-31 ruling: instant Jump/iPad re-attach outranks lock)"
+  # DISABLED by human ruling 2026-09-01 (#611): the always-alive autologin
+  # console session held the user's single plasmashell instance and
+  # black-screened every RDP login (Plasma 6 = one shell per user).
+  # RDP does not need autologin; Sunshine (when it lands with the GPU)
+  # gets a dedicated kiosk account or XFCE instead. Do not re-arm.
+  gate "sddm autologin (DISABLED 2026-09-01, #611)" || return 0
+  rm -f /etc/sddm.conf.d/50-ukrrs-autologin.conf
+  say "sddm autologin REMOVED if present; console shows greeter at boot; RDP unaffected"
 }
 step_daynight() {
   gate "install day/night profile timers" || return 0