PLN reported "too sticky" a SECOND time, and the latch was not the whole
answer. The unit is Restart=always -- correctly, since an unplugged LCXL used
to make this process exit cleanly and Restart=on-failure ignored it, leaving
his window gone for the rest of a session. But Restart=always cannot tell that
exit from a person clicking the X, so a deliberate close came back five
seconds later. I had asserted in an earlier commit that "a clean exit is not a
failure so systemd never restarted it"; that was true of the old unit and
stopped being true when the restart policy changed underneath it.

Two supervisors had to be told, and having convinced only one of them looked
exactly like having convinced neither:

  rig_units.ensure()  -> the $XDG_RUNTIME_DIR latch (already landed)
  systemd             -> this commit

midiviz.py now exits USER_CLOSE_EXIT=78 when the close was deliberate (the X,
Q, Esc -- never a compositor teardown, and only when the exit was otherwise
clean, so a real failure keeps its own code and stays restartable), and the
unit exempts exactly that status with RestartPreventExitStatus=78. Every
failure mode still comes back; a person closing the window does not.

The number is written in two files, so a test asserts they are the same
number, and that it collides with neither a normal exit (0/1) nor the 128+N
signal range. If they ever drift, the symptom is the window reappearing five
seconds after being closed -- which reads as a broken close rather than a
mismatched integer, and would send somebody hunting the wrong layer for the
third time.