docs(desktop): updates are admin-only — keep the polkit prompt; AppImage rejected on field evidence

Decision (user, 2026-09-04) after the first successful self-update
(v0.1.6 → v0.1.7): a .deb update runs pkexec dpkg -i and asks for an admin
password the operator does not have — that prompt is the intended gate.
The AppImage was tried as the no-root path and aborts on the 26.04 booth
(bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa: EGL_BAD_PARAMETER), and it
discards the distro-maintained WebKitGTK the platform decision rests on.
Passwordless polkit for dpkg is root for the operator — rejected.

- update.prompt (en + sq) now says the install needs the administrator
  password.
- desktop-shell-tauri.md: decision, evidence, rejected alternatives, and the
  deferred fleet-grade option (root systemd timer in the .deb, minisign-
  verified, notify-only in-app).
- standing-decisions.md: ship the .deb; runtime backend; updates admin-only.
- appliance-provisioning.md: drop the stale "hardcoded to localhost" note.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/desktop-shell-tauri.md

@@ -455,3 +455,32 @@ Sources: `tauri-plugin-updater-2.10.1/src/updater.rs` (`get_urls`, `install_inne
 - **Judgment note for the retrospective:** three fixes were shipped against this symptom
   without reading the updater's install path once. The whole chain is ~60 lines of vendored
   Rust in `~/.cargo/registry`; it names the exact failure (`InvalidUpdaterFormat`).
+
+### Decision: desktop updates are an admin-only action — the polkit prompt stays (2026-09-04)
+
+Settled with the user after the first successful self-update (v0.1.6 → v0.1.7 on the park-2
+booth, `pkexec dpkg -i`, polkit dialog, relaunch, badge shows 0.1.7). The prompt asks for an
+**admin** password the operator does not have — and that is now the intended gate, not a defect.
+
+- **AppImage was tried and rejected on evidence, not theory.** The v0.1.6 AppImage fails to
+  start on the Ubuntu 26.04 booth: `libgvfscommon.so: undefined symbol:
+  g_variant_builder_init_static` (the host's newer gvfs modules loading into the *bundled* older
+  glib) followed by `Could not create default EGL display: EGL_BAD_PARAMETER. Aborting...` (the
+  bundled WebKitGTK vs. the host's Mesa). Tauri's AppImage freezes the CI runner's (24.04)
+  GTK/WebKitGTK/glib into the bundle, which throws away the one property this platform decision
+  rests on — the **distro-maintained, Canonical-patched WebKitGTK** — and replaces it with a
+  host-mismatch hazard at every OS update. `WEBKIT_DISABLE_DMABUF_RENDERER=1` /
+  `WEBKIT_DISABLE_COMPOSITING_MODE=1` may paper over the EGL abort; they don't fix the shape.
+  **The `.deb` is the right artifact; only its install step needs root.**
+- **Passwordless polkit/sudoers for `dpkg -i` rejected:** any rule that lets the operator
+  account pass that prompt silently lets them run `pkexec dpkg -i <anything>` — root — which the
+  [[threat-model]] forbids outright.
+- **Deferred, not rejected — the fleet-grade answer:** a root systemd timer shipped inside the
+  `.deb` (via Tauri's deb `files` + postinstall) that fetches `latest.json` from
+  `public_releases`, verifies the `.deb` with `minisign` against the same embedded pubkey, and
+  `dpkg -i`s it when the box is online; the in-app updater then only *notifies*. No prompt, no
+  privileged code in the shell, standard appliance practice. Revisit when more than one booth
+  needs keeping current, or when someone other than the admin has to bring a box online.
+- **Operator-facing consequence:** the in-app prompt now says the install needs the
+  administrator password (i18n `update.prompt`, en + sq). An operator who accepts and can't
+  authenticate simply stays on the current version; nothing breaks, and the failure is logged.