perf(deploy): enable GPU acceleration by default, except on douro

The kiosk has launched with --disable-gpu AND
--disable-software-rasterizer since the first ISO commit (19d43c2).
Together those turn off GPU compositing and the SwiftShader fallback,
leaving Chromium to rasterise every pixel on the CPU — on Atom-class
hardware, for no reason anyone wrote down. No comment, no issue, no
commit message ever justified the pair, and /etc/bitspire/config.env has
claimed ELECTRON_DISABLE_GPU=false the whole time, contradicting the
actual command line.

Tested on sintra today. With the flags gone the GPU process is stable —
zero crashes, zero service restarts — and genuinely on hardware:
/proc/<gpu-pid>/maps shows libgallium, libGLX_mesa and dri_gbm, with no
swrast and no SwiftShader. It renders through crocus on Braswell.
Confirmed by eye on the panel, which is the part no log could answer.

Worth noting what the first attempt looked like, because it read as a
failure and was not. Restarting the unit logged "GPU process exited
unexpectedly: exit_code=15" and "has crashed 1 time(s)" — but those came
from the OUTGOING process being SIGTERMed by the restart. The incoming
one logged nothing. Checking crash counts and the gpu-process pid across
an interval, rather than grepping the last sixty lines, is what separates
the two.

DOURO KEEPS THE OLD FLAGS. Bay Trail already carries three display
workarounds — a 5.15 kernel pin for an i915 eDP regression,
i915.enable_psr=0, and vt.handoff=7 to preserve the BIOS display init —
which makes it the one machine where the original flags plausibly fixed
something real rather than being bring-up scaffolding. It is also down
pending a reflash, so it cannot be tested. Shipping an untested display
change to the most display-fragile box in the fleet, to be discovered
whenever it comes back, is not a trade worth making for one machine's
frame rate. Drop the exemption once douro is back and accelerates
cleanly.

The env override still works on every machine, douro included, so this
can be flipped either way without a rebuild.

flake.nix

@@ -53,32 +53,49 @@
         overlays = [ (import rust-overlay) ];
       };
 
-      # Kiosk launcher. The GPU-related Electron flags sit in a variable with a
-      # shell default rather than being baked into ExecStart, so they can be
-      # changed on a running machine by editing /var/lib/bitspire/.env and
-      # restarting the unit. No rebuild, no reboot, and a bad value is one edit
-      # away from being undone. That matters on a box whose screen nobody can
-      # see: a rebuild-and-pray loop over WireGuard is the wrong tool for
-      # finding out which flags a given panel tolerates.
+      # Kiosk launcher. The GPU-related Electron flags sit in a shell variable
+      # rather than being baked into ExecStart, so they can be changed on a
+      # running machine by editing /var/lib/bitspire/.env and restarting the
+      # unit. No rebuild, no reboot, and a bad value is one edit away from
+      # being undone — which matters on a box whose screen nobody can see.
       #
-      # The default reproduces exactly what these machines have shipped since
-      # the first ISO (19d43c2): GPU compositing off AND the software
-      # rasterizer off, which leaves Chromium rasterizing every pixel on the
-      # CPU. Nothing in git ever justified that pair. It arrived with the
-      # original bring-up commit and was carried forward through every
-      # refactor since, and it is expensive on a Bay Trail Atom.
+      # THE DEFAULT IS NOW HARDWARE ACCELERATION.
       #
-      # Values to try in /var/lib/bitspire/.env:
-      #   BITSPIRE_ELECTRON_GPU_FLAGS=                full acceleration
-      #   BITSPIRE_ELECTRON_GPU_FLAGS=--disable-gpu   no GPU, SwiftShader allowed
-      #   BITSPIRE_ELECTRON_GPU_FLAGS=--use-gl=egl    force EGL if GLX misbehaves
-      #   (line absent)                               the shipped default below
+      # From the first ISO commit (19d43c2) until today the kiosk launched with
+      # --disable-gpu AND --disable-software-rasterizer, which turns off GPU
+      # compositing and the SwiftShader fallback together and leaves Chromium
+      # rasterising every pixel on the CPU. Nothing in git ever justified the
+      # pair: no comment, no issue, no commit message. Meanwhile the
+      # descriptive config at /etc/bitspire/config.env claimed
+      # ELECTRON_DISABLE_GPU=false, contradicting the actual command line.
       #
-      # Note `-` and not `:-`. An explicitly EMPTY value means "no GPU flags at
-      # all", i.e. full acceleration, and must not fall back to the default.
-      # Unquoted on purpose so the value word-splits into argv.
-      mkKioskLauncher = atm-app: pkgs.writeShellScript "bitspire-kiosk" ''
-        default_gpu_flags="--disable-gpu --disable-software-rasterizer"
+      # Tested on sintra 2026-09-24. With the flags removed the GPU process is
+      # stable (zero crashes, zero service restarts) and genuinely on hardware
+      # — /proc/<gpu-pid>/maps shows libgallium, libGLX_mesa and dri_gbm, with
+      # no swrast and no SwiftShader — rendering through crocus on Braswell.
+      # Confirmed by eye on the panel.
+      #
+      # DOURO IS EXEMPT. It keeps the old flags. Bay Trail carries three
+      # separate display workarounds already — a 5.15 kernel pin for an i915
+      # eDP regression, i915.enable_psr=0, and vt.handoff=7 to preserve the
+      # BIOS display init — so it is the most plausible machine for the
+      # original flags to have been a real fix rather than scaffolding. It is
+      # also down pending a reflash, so it cannot be tested. Drop this
+      # exemption once douro is back and accelerates cleanly.
+      #
+      # To override per machine, in /var/lib/bitspire/.env:
+      #   BITSPIRE_ELECTRON_GPU_FLAGS=                             acceleration
+      #   BITSPIRE_ELECTRON_GPU_FLAGS=--disable-gpu                no GPU
+      #   BITSPIRE_ELECTRON_GPU_FLAGS=--use-gl=egl                 force EGL
+      #   (line absent)                                            model default
+      #
+      # Note `-` and not `:-`: an explicitly EMPTY value means "no GPU flags at
+      # all", and must not fall back to the default. Unquoted on purpose so the
+      # value word-splits into argv.
+      mkKioskLauncher = machineModel: atm-app: pkgs.writeShellScript "bitspire-kiosk" ''
+        default_gpu_flags="${
+          if machineModel == "douro" then "--disable-gpu --disable-software-rasterizer" else ""
+        }"
         exec ${pkgs-unstable.electron}/bin/electron \
           --no-sandbox --disable-gpu-sandbox --enable-logging \
           ''${BITSPIRE_ELECTRON_GPU_FLAGS-$default_gpu_flags} \
@@ -113,7 +130,7 @@
           inherit system;
           specialArgs = {
             inherit pkgs-unstable nixpkgs machineModel atm-app;
-            kioskLauncher = mkKioskLauncher atm-app;
+            kioskLauncher = mkKioskLauncher machineModel atm-app;
           };
           modules = [
             ./deploy/nixos/live.nix
@@ -265,7 +282,7 @@
                 serviceConfig = {
                   EnvironmentFile = lib.mkForce "/var/lib/bitspire/.env";
                   Environment = "LD_LIBRARY_PATH=${pkgs.stdenv.cc.cc.lib}/lib";
-                  ExecStart = lib.mkForce "${mkKioskLauncher atm-app}";
+                  ExecStart = lib.mkForce "${mkKioskLauncher machineModel atm-app}";
                   MemoryMax = lib.mkForce "1G";
                   NoNewPrivileges = lib.mkForce false;
                   ProtectSystem = lib.mkForce false;