fix(rig): neither painter may be auto-started blind

lcxl3-driver was policy "login", so rig_units.ensure() started it
whenever it was not already active -- and ensure() runs inside
gig-up.sh --converge, which is what the Bridge's RIG UP calls.

With the CLASSIC LCXL plugged that is actively destructive: the v3
driver has Conflicts=lcxl-leds-watch, so a converge would stop the
painter that was correctly lighting the classic board, then fail to bind
(there is no LCXL3 port) and crash-loop at RestartSec=5. That is exactly
what happened between 11:26 and 14:36 on 2026-09-05 -- 86 restarts, the
board dark the whole time -- and today's repair would have been undone
by the next press of GIG UP.

lcxl-leds-watch was already "manual" for the mirror-image reason, stated
in the comment right below this one. The rule generalises: neither
painter may be auto-started blind, because "which painter" is a question
only the plugged hardware can answer. gig-up.sh's leds() is the
generation-aware chooser -- it greps aconnect for LCXL3 and restarts the
right unit -- and it now owns the decision outright.

Verified: `rig_units.py --ensure` (dry) reports "nothing to do" with the
driver inactive and the v2 painter running, instead of queueing a start
that would have gone dark.

Trade-off worth knowing: on a mk3 rig the driver no longer comes up at
login, so faders reach Ardour only after gig-up runs. That is the price
of not guessing the generation, and gig-up is the documented bring-up.

tools/rig_units.py

@@ -68,7 +68,16 @@ SERVICES = [
     # translates the v3 DAW protocol to the corpus's v2 CCs (fader → Ardour
     # gains included) and owns paint + OLED. Conflicts= with lcxl-leds-watch:
     # one painter per board, whichever surface generation is plugged.
-    ("lcxl3-driver",           "LCXL3 driver", None,     "login",     "v3 surface → v2 CCs + paint + OLED"),
+    # "manual" since 2026-09-05, symmetric with lcxl-leds-watch below and for
+    # the same reason read the other way round. ensure() starts every non-manual
+    # unit that is not active, and this one Conflicts= the v2 painter -- so with
+    # the CLASSIC board plugged, a converge would start the v3 driver, kill the
+    # painter that was correctly lighting the classic, and then crash-loop at
+    # RestartSec=5 because there is no LCXL3 port to bind (86 attempts between
+    # 11:26 and 14:36 that day). Neither painter may be auto-started blind:
+    # gig-up.sh's leds() is the generation-aware chooser (it greps aconnect for
+    # LCXL3 and restarts the right one), and it owns this decision.
+    ("lcxl3-driver",           "LCXL3 driver", None,     "manual",    "v3 surface → v2 CCs + paint + OLED"),
     # "manual" since 2026-09-05: this is the ORIGINAL LCXL's painter. On the
     # LCXL3 rig it fails forever misdiagnosing a USB OUT stall, and starting it
     # Conflicts=-kills lcxl3-driver — so neither boot nor --ensure may start