fix(rpi-usb): relative symlink for graphical.target.wants (ref #436)

v2.13.8 still failed the kiosk assertion. PR #439's `ln -sf
"/etc/systemd/system/secubox-kiosk.service"` created an *absolute*
symlink that, from the host's perspective, points to
`/etc/systemd/system/secubox-kiosk.service` on the HOST filesystem
(which doesn't exist there). `[[ -e symlink ]]` follows the target,
so the check returned false even though the symlink itself was
present at the right path.

Switch to a *relative* target (`../secubox-kiosk.service`) :
- matches systemctl's own convention for WantedBy symlinks
- resolves correctly inside the chroot at runtime
- resolves correctly from the host's assertion check at build time

This should be the actual last piece. Build chain: chroot safety net
(PR #437) → bigger tmpfs + /proc/sys (PR #438) → WantedBy symlink
(PR #439 absolute, this PR relative) → assertion passes → image ships.

image/build-rpi-usb.sh

@@ -912,11 +912,14 @@ KIOSKSVC
         || err "systemctl enable secubox-kiosk.service failed"
 
     # Belt-and-suspenders: `systemctl enable` under SYSTEMD_OFFLINE in a qemu
-    # chroot doesn't always materialise the WantedBy symlink (observed in
-    # v2.13.7). Create it explicitly so the next assertion passes regardless
-    # of whether systemctl's offline behaviour wrote the link itself.
+    # chroot doesn't always materialise the WantedBy symlink (observed v2.13.7).
+    # Create it with a *relative* target (matches systemctl's own convention
+    # and resolves correctly both inside the chroot AND from the host's
+    # assertion check — v2.13.8 used an absolute "/etc/..." path which the
+    # host's `[[ -e symlink ]]` could not resolve because the absolute target
+    # doesn't exist on the host fs).
     install -d "${ROOTFS}/etc/systemd/system/graphical.target.wants"
-    ln -sf "/etc/systemd/system/secubox-kiosk.service" \
+    ln -sf "../secubox-kiosk.service" \
            "${ROOTFS}/etc/systemd/system/graphical.target.wants/secubox-kiosk.service"
 
     # Build-time assertion (#433): verify EVERY kiosk artefact made it into