feat: enable the podman API socket and ship the camera udev grantHEADmain

Two one-time machine setups from the winvm handoffs now happen at install time.

- The devops podman block enables the rootless podman API socket. Socket-activated, so it costs nothing idle, and API clients like Pods fail with an empty window without it. enable_user_service grew an optional wants-target argument because a socket unit's [Install] is WantedBy=sockets.target. The old default.target link would never socket-activate.
- install_camera_passthrough_rules ships 72-usb-passthrough-cameras.rules: GROUP="video", MODE="0660" plus the uaccess tag on the OBSBOT and BRIO USB IDs, so usbredirect can claim them for VM passthrough. The filename is load-bearing: logind's ACL is applied by 73-seat-late.rules, so the tag only works from a file sorting below 73. A test pins that property.

Both are live on ratio (the old 99- rules file is retired there). Whether uaccess alone would suffice from the corrected position is untested and stays documented as a hypothesis.

1 files changed, 27 insertions, 0 deletions

diff --git a/tests/installer-steps/test_idempotency_cluster.py b/tests/installer-steps/test_idempotency_cluster.py
index ecb279d..0cca750 100644
--- a/tests/installer-steps/test_idempotency_cluster.py
+++ b/tests/installer-steps/test_idempotency_cluster.py
@@ -114,6 +114,33 @@ class EnableUserService(unittest.TestCase):
             out = run("enable_user_service", one).stdout
             self.assertIn("RC=0", out)
 
+    def test_socket_unit_lands_in_sockets_target_wants(self):
+        # A socket unit's [Install] is WantedBy=sockets.target, so enabling it
+        # via default.target.wants would never socket-activate. The optional
+        # fifth arg names the wants target.
+        with tempfile.TemporaryDirectory() as home:
+            body = (
+                f'enable_user_service {ME!r} podman.socket '
+                f'/usr/lib/systemd/user/podman.socket {home!r} sockets.target\n'
+                f'link="{home}/.config/systemd/user/sockets.target.wants/podman.socket"\n'
+                f'[ -L "$link" ] && echo "LINK=yes" || echo "LINK=no"\n'
+                f'echo "TARGET=$(readlink "$link")"'
+            )
+            out = run("enable_user_service", body).stdout
+            self.assertIn("LINK=yes", out)
+            self.assertIn("TARGET=/usr/lib/systemd/user/podman.socket", out)
+
+    def test_omitted_target_still_defaults_to_default_target(self):
+        with tempfile.TemporaryDirectory() as home:
+            body = (
+                f'enable_user_service {ME!r} gamemoded.service '
+                f'/usr/lib/systemd/user/gamemoded.service {home!r}\n'
+                f'[ -L "{home}/.config/systemd/user/default.target.wants/gamemoded.service" ] '
+                f'&& echo "DEFAULT=yes" || echo "DEFAULT=no"'
+            )
+            out = run("enable_user_service", body).stdout
+            self.assertIn("DEFAULT=yes", out)
+
 
 if __name__ == "__main__":
     unittest.main()