fix(iso-visuals): wallpaper-on-join honors tmp policy + applies on real hardware

Follow-up to #74. Two concrete fixes to the "identity wallpaper on join" step:

1. tmp policy: the join script hardcoded WP=/tmp/clawdie-wallpaper.png, passing
   it to clawdie-wallpaper-gen and overriding the safe SCRATCH_DIR default that
   9ae8d25 had just introduced (project-local tmp/ or app-owned cache). The
   generator now prints its chosen path on stdout (human note → stderr) and the
   join script captures it: WP=$(clawdie-wallpaper-gen). No host-global /tmp.

2. wallpaper actually applies: replaced the hardcoded
   /backdrop/screen0/monitor0/workspace0/last-image with an enumeration over
   every existing */last-image property (XFCE keys backdrops by connector name,
   e.g. monitorHDMI-1, not monitor0), falling back to creating the default
   property on first boot/headless, then xfdesktop --reload.

SKILL.md updated to document the stdout contract and multi-monitor wiring.

Validation: sh -n on both scripts; prettier@3 --check SKILL.md;
python3 scripts/layered_soul.py validate . — all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

skills/iso-visuals/SKILL.md

@@ -76,15 +76,16 @@ where there is usually no project root, it uses an app-owned cache directory suc
 `$XDG_CACHE_HOME/clawdie` or `$HOME/.cache/clawdie`. It should not try to create
 files under `/usr/local/share` at runtime unless explicitly requested by the operator.
 
-**Optional runtime/session wiring:**
+**Optional runtime/session wiring:** the helper prints the output path it chose on
+stdout (human note goes to stderr), so callers capture it rather than guessing a
+path. XFCE keys backdrops by connector name (`monitorHDMI-1`, `monitoreDP-1`, …),
+not a fixed `monitor0`, so set every `*/last-image` property:
 
 ```bash
-PROJECT_ROOT=$(git rev-parse --show-toplevel)
+WP=$(/usr/local/bin/clawdie-wallpaper-gen)
-PROJECT_TMP="$PROJECT_ROOT/tmp"
+for p in $(xfconf-query -c xfce4-desktop -l | grep '/last-image$'); do
-mkdir -p "$PROJECT_TMP"
+  xfconf-query -c xfce4-desktop -p "$p" -s "$WP"
-/usr/local/bin/clawdie-wallpaper-gen "$PROJECT_TMP/clawdie-wallpaper.png"
+done
-xfconf-query -c xfce4-desktop -p /backdrop/screen0/monitor0/workspace0/last-image \
-  -s "$PROJECT_TMP/clawdie-wallpaper.png"
 ```
 
 Requires ImageMagick (`ImageMagick7` in the ISO package list; `magick` or
@@ -143,7 +144,8 @@ The launcher runs in `xfce4-terminal` with geometry 80x24 and pauses on
   idempotent success;
 - does not fail just because `/usr/local/etc/colibri/provider.env` is mode `0600`;
 - uses `mdo -u root` for privileged checks/start where available;
-- on success, generates and applies the identity wallpaper as visual confirmation;
+- on success, generates the identity wallpaper at the generator's chosen path (no
+  host-global `/tmp`) and applies it across all monitors as visual confirmation;
 - never prints Vaultwarden credentials or provider keys.
 
 ## Build integration (`clawdie-iso` `build.sh`)
@@ -174,7 +176,8 @@ After booting the ISO:
    already registered, then waits for Enter.
 4. **Wallpaper helper:** running `/usr/local/bin/clawdie-wallpaper-gen` writes an
    image under project-local `tmp/` when run from a checkout, or an app-owned live
-   cache directory when no project root exists, using the Clawdie wallpaper as base.
+   cache directory when no project root exists, using the Clawdie wallpaper as base,
+   and prints that path on stdout (the human `Wallpaper: …` note goes to stderr).
 5. **Panel indicator helper:** running `/usr/local/bin/colibri-panel-indicator`
    prints genmon XML. Only claim panel visibility after genmon is packaged and
    wired into the seeded panel or configured manually.

skills/iso-visuals/scripts/clawdie-join-hive.sh

@@ -127,12 +127,26 @@ fi
 echo "[4/4] Agent ${AGENT_NAME} is live on the Colibri board."
 echo ""
 
-if have clawdie-wallpaper-gen; then
+if have clawdie-wallpaper-gen && have xfconf-query; then
     echo "       Setting identity wallpaper..."
-    if have xfconf-query; then
+    # Let the generator pick a policy-compliant path (project-local tmp/ or an
-        WP="/tmp/clawdie-wallpaper.png"
+    # app-owned cache dir) and report it on stdout — no host-global /tmp here.
-        clawdie-wallpaper-gen "$WP" 2>/dev/null && \
+    WP=$(clawdie-wallpaper-gen 2>/dev/null)
-            xfconf-query -c xfce4-desktop -p /backdrop/screen0/monitor0/workspace0/last-image -s "$WP" 2>/dev/null
+    if [ -n "$WP" ] && [ -f "$WP" ]; then
+        # XFCE keys backdrops by connector name (monitorHDMI-1, monitoreDP-1, ...),
+        # not a fixed "monitor0". Set every existing last-image property so the
+        # change actually applies on real hardware.
+        _applied=0
+        for _prop in $(xfconf-query -c xfce4-desktop -l 2>/dev/null | grep '/last-image$'); do
+            xfconf-query -c xfce4-desktop -p "$_prop" -s "$WP" 2>/dev/null && _applied=1
+        done
+        # First boot / headless: no backdrop props exist yet — create the default.
+        if [ "$_applied" -eq 0 ]; then
+            xfconf-query -c xfce4-desktop \
+                -p /backdrop/screen0/monitor0/workspace0/last-image \
+                -n -t string -s "$WP" 2>/dev/null
+        fi
+        xfdesktop --reload >/dev/null 2>&1 || true
     fi
 fi
 

skills/iso-visuals/scripts/clawdie-wallpaper-gen.sh

@@ -85,4 +85,7 @@ if ! im "$BG" \
     cp "$BG" "$OUT"
 fi
 
-echo "Wallpaper: ${OUT}"
+# stdout is the bare output path (machine-readable for callers that capture it,
+# e.g. `WP=$(clawdie-wallpaper-gen)`); human-facing note goes to stderr.
+echo "Wallpaper: ${OUT}" >&2
+printf '%s\n' "$OUT"