fix(mediaflow,rpi400): postinst #DEBHELPER# comment bug + kiosk conffile prompts

Two failures surfaced by the strict apt-get pass that --kiosk runs in the
rpi chroot (the lenient `dpkg -i --force-depends || true` had been swallowing
the first one on every build):

1. secubox-mediaflow postinst had `#DEBHELPER#` inside a comment. dh_installsystemd
   substitutes that token textually wherever it appears, so it expanded the
   systemd block mid-comment and orphaned "; kick one refresh" onto its own
   line → `syntax error near ';'` → configure fails on EVERY install. Reword
   the comment (real token stays alone on line 22). Bump to ~bookworm3.

2. The kiosk apt-get relied on DEBIAN_FRONTEND=noninteractive, which governs
   debconf, not dpkg's conffile prompt — a pre-existing /etc/secubox/mesh.toml
   triggered an interactive prompt that EOFs on the closed chroot stdin and
   aborted the build. Pass --force-confdef/--force-confold (as the main
   dpkg --configure pass already does) to auto-keep existing conffiles.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>

image/build-rpi-usb.sh

@@ -924,8 +924,14 @@ if [[ "${INCLUDE_KIOSK}" -eq 1 ]]; then
     # to proceed regardless). The fail-loud is on the kiosk install below,
     # not on fix-broken.
     log "  apt --fix-broken install (best-effort, pre-existing state cleanup)"
+    # DEBIAN_FRONTEND=noninteractive governs debconf, NOT dpkg's conffile
+    # prompt — a pre-existing /etc/secubox/*.toml still triggers an interactive
+    # "install maintainer's version?" that EOFs on the closed chroot stdin and
+    # aborts the run. --force-confdef/--force-confold auto-answer (keep current),
+    # matching the main dpkg --configure pass above.
+    _DPKG_CONF='-o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold'
     chroot "${ROOTFS}" /bin/bash -c \
-        'DEBIAN_FRONTEND=noninteractive apt-get --fix-broken install -y -q' \
+        "DEBIAN_FRONTEND=noninteractive apt-get --fix-broken install -y -q ${_DPKG_CONF}" \
         || warn "apt --fix-broken install reported errors (continuing — kiosk install will report its own)"
 
     # Fail-loud on apt errors (was silently masked with || warn, #433 root cause).
@@ -934,9 +940,9 @@ if [[ "${INCLUDE_KIOSK}" -eq 1 ]]; then
     # apt to satisfy deps even with some pre-existing broken state.
     log "  apt-get install kiosk stack"
     chroot "${ROOTFS}" /bin/bash -c \
-        'DEBIAN_FRONTEND=noninteractive apt-get install -y -q -f --no-install-recommends \
+        "DEBIAN_FRONTEND=noninteractive apt-get install -y -q -f --no-install-recommends ${_DPKG_CONF} \
             xserver-xorg xinit openbox chromium x11-xserver-utils \
-            ca-certificates dbus-x11' \
+            ca-certificates dbus-x11" \
         || err "apt-get install failed inside chroot — kiosk packages required when --kiosk is passed"
 
     KIOSK_SRC="${SCRIPT_DIR}/kiosk"

packages/secubox-mediaflow/debian/changelog

@@ -1,3 +1,12 @@
+secubox-mediaflow (2.3.0-1~bookworm3) bookworm; urgency=medium
+
+  * Fix postinst syntax error: a comment contained the literal #DEBHELPER#
+    token, which dh_installsystemd substituted textually, orphaning the rest
+    of the line ("; kick one refresh") and breaking `configure` on every
+    install. Reword the comment; the real token stays on its own line.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Wed, 22 Jul 2026 12:00:00 +0200
+
 secubox-mediaflow (2.3.0-1~bookworm2) bookworm; urgency=medium
 
   * Phase 2: Requires=secubox-core.service -> Wants= on this module's unit

packages/secubox-mediaflow/debian/postinst

@@ -14,8 +14,10 @@ case "$1" in
     systemctl start  secubox-mediaflow.service || true
     install -d -m 755 /etc/nginx/secubox.d
     systemctl reload nginx 2>/dev/null || true
-    # R4 cloner (#736): the .timer is enabled via #DEBHELPER#; kick one refresh
-    # now so yt-dlp is current on first install (best-effort, never fails).
+    # R4 cloner (#736): the .timer is enabled by the dh_installsystemd block
+    # below; kick one refresh now so yt-dlp is current on first install
+    # (best-effort, never fails). NB: never write the debhelper token in a
+    # comment — dh substitutes it textually and orphans the rest of the line.
     systemctl start secubox-yt-dlp-refresh.service 2>/dev/null || true
     ;;
 esac