fix(lva-peripheral): re-enable linger for UID 1000 at boot

Background: PipeWire's PulseAudio compat socket lives under /run/user/1000.
The LVA container bind-mounts that path so the audio thread inside the
container can record from the mic. /run/user/1000 is a session-scoped
tmpfs by default — only created while the user has an active session,
torn down and re-mounted with a new inode each time. When the LVA
container's bind-mount points at a stale inode, ``pactl info`` from
inside the container returns "Connection refused" and the audio thread
crashes with "Recording failed, stream is in status FAILED", which
surfaces in Home Assistant as "the voice assistant is unable to connect
to Home Assistant".

The pipewire stage (01-stage-picompose/03-install-pipewire-audio) already
addresses this by enabling linger for the ``pi`` user. But Pi Imager's
first-boot wizard normally renames ``pi`` to whatever username the user
supplied, which leaves the linger file orphaned under the old name and
the actual runtime user without linger.

Fix: ship a tiny oneshot systemd unit that runs at every boot (before
picompose.service), reads the username currently owning UID 1000, and
touches /var/lib/systemd/linger/$USER. Idempotent, covers both the
renamed and un-renamed cases, and makes the linger setting survive
re-flashes by being part of the image rather than something the
operator has to remember to enable.

Author: genericJE

03-stage-lva-2mic-peripheral/01-lva-peripheral/01-run.sh

@@ -60,7 +60,21 @@ install -v -D -m 755 files/lva-peripheral-gpiochip-fix.sh \
 install -v -D -m 644 files/lva-peripheral-gpiochip-fix.service \
     "${ROOTFS_DIR}/etc/systemd/system/lva-peripheral-gpiochip-fix.service"
 
-# Group membership + SPI overlay + enable the gpiochip-fix unit inside the chroot.
+# Helper that enables systemd linger for whoever UID 1000 ends up being at
+# runtime. Pi Imager's first-boot wizard typically renames ``pi`` to a
+# user-supplied name, orphaning the linger file the pipewire stage already
+# created under /var/lib/systemd/linger/pi. Without linger, /run/user/1000
+# (where PipeWire's PulseAudio socket lives) is session-scoped: the moment
+# the user SSHs out, the tmpfs is torn down, and the LVA container's
+# bind-mount of /run/user/1000 goes stale — audio capture starts failing
+# with "Connection refused" and HA shows "voice assistant unable to
+# connect".  Runs once at boot before picompose deploys.
+install -v -D -m 755 files/lva-peripheral-linger-fix.sh \
+    "${ROOTFS_DIR}/usr/local/sbin/lva-peripheral-linger-fix.sh"
+install -v -D -m 644 files/lva-peripheral-linger-fix.service \
+    "${ROOTFS_DIR}/etc/systemd/system/lva-peripheral-linger-fix.service"
+
+# Group membership + SPI overlay + enable the helper units inside the chroot.
 on_chroot << 'EOF'
 getent group spi  >/dev/null && usermod -aG spi  pi || true
 getent group gpio >/dev/null && usermod -aG gpio pi || true
@@ -74,6 +88,7 @@ grep -q "^dtparam=spi=on$" "$CONFIG" || echo "dtparam=spi=on" >> "$CONFIG"
 
 systemctl daemon-reload
 systemctl enable lva-peripheral-gpiochip-fix.service
+systemctl enable lva-peripheral-linger-fix.service
 EOF
 
 rm -rf "$SRC"

03-stage-lva-2mic-peripheral/01-lva-peripheral/files/lva-peripheral-linger-fix.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Enable systemd linger for the UID 1000 runtime user (LVA peripheral)
+ConditionPathExists=/compose/lva-peripheral/docker-compose.yml
+After=local-fs.target
+Before=picompose.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/lva-peripheral-linger-fix.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

03-stage-lva-2mic-peripheral/01-lva-peripheral/files/lva-peripheral-linger-fix.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Ensure linger is enabled for whoever ends up at UID 1000.
+#
+# The LVA peripheral compose runs the containers as the host's UID 1000
+# (compose's ``user: "${LVA_USER_ID:-1000}:..."``) and bind-mounts the host's
+# ``/run/user/1000`` so the container can reach PipeWire's PulseAudio socket
+# for microphone capture.  Without linger, ``/run/user/1000`` is a tmpfs that
+# only exists while a session is active — meaning audio capture breaks the
+# moment the user SSHs out, and the next bind-mount inside the container goes
+# stale.
+#
+# PiCompose's pipewire stage enables linger for the built-in ``pi`` user, but
+# Pi Imager's first-boot wizard often renames ``pi`` → something else (e.g.
+# ``je``), orphaning the linger file under the old name.  Do it again here at
+# boot time using whatever username currently owns UID 1000.
+
+set -e
+
+RUNTIME_USER="$(getent passwd 1000 | cut -d: -f1 || true)"
+if [ -z "$RUNTIME_USER" ]; then
+    echo "lva-peripheral-linger-fix: no user at UID 1000, skipping" >&2
+    exit 0
+fi
+
+mkdir -p /var/lib/systemd/linger
+touch "/var/lib/systemd/linger/$RUNTIME_USER"
+chmod 644 "/var/lib/systemd/linger/$RUNTIME_USER"
+echo "lva-peripheral-linger-fix: linger enabled for $RUNTIME_USER"