fix(midiviz): a close PLN asked for is not a unit failure

Observed for real: he closed the window at 21:40:31, a minute after the
deploy. Exit 78, systemd correctly did not restart it, the latch was written
the same second, and rig --ensure reported "CLOSED by hand — leaving it
alone". The whole chain worked on the first real human close.

And then the unit sat in `failed (result: exit-code)`, because
RestartPreventExitStatus only governs the RESTART -- systemd still classifies
a non-zero exit as a failure. So the feature working correctly showed up red
in systemctl, in rig --status, and on the Bridge panel. That is worse than
cosmetic: the next person debugging this rig starts by "fixing" a unit that is
behaving exactly as designed, which is the third time this week something has
sent someone after the wrong layer.

SuccessExitStatus=78 alongside it. The two keys do different jobs and both are
needed: one stops the restart, the other stops the lie.

The test now asserts both keys carry the same number as the code, since the
symptom of drift in either direction looks like a bug somewhere else -- a
window that reappears, or a green unit that reads red.

tools/bridge/tests/test_midiviz.py

@@ -293,3 +293,14 @@ def test_user_close_exit_code_matches_the_unit():
     # Must not collide with the codes a normal run or a signal produces.
     assert mv.USER_CLOSE_EXIT not in (0, 1), "collides with a normal exit"
     assert mv.USER_CLOSE_EXIT < 128, "collides with the 128+N signal range"
+
+    # Preventing the restart is only half of it: without SuccessExitStatus,
+    # systemd files a deliberate close as `failed (result: exit-code)` and the
+    # unit shows red everywhere the rig is monitored, which sends the next
+    # person to debug a unit that is behaving perfectly.
+    ok = re.search(r"^SuccessExitStatus=(.+)$", unit, re.M)
+    assert ok, ("midiviz.service has no SuccessExitStatus, so a close the "
+                "human asked for will be reported as a unit failure")
+    assert str(mv.USER_CLOSE_EXIT) in ok.group(1).split(), (
+        f"SuccessExitStatus={ok.group(1)!r} does not include "
+        f"{mv.USER_CLOSE_EXIT}")

tools/midiviz.service

@@ -40,6 +40,15 @@ Restart=always
 # a person actually close the thing. The latch in $XDG_RUNTIME_DIR stops
 # rig_units.ensure() from starting it again in the same breath; this stops
 # systemd. Both were needed, and only having one of them looked like neither.
+# Both, and they do different jobs. RestartPreventExitStatus stops the
+# restart; without SuccessExitStatus, systemd still classifies a non-zero exit
+# as a failure, so a close PLN asked for left the unit sitting in
+# `failed (result: exit-code)` -- red in systemctl, red in rig --status, red on
+# the Bridge panel. A deliberate close is not a fault and must not look like
+# one, or the next person debugging this rig starts by "fixing" a unit that is
+# working exactly as designed. Observed for real 2026-09-05 21:40:31, when PLN
+# closed the window a minute after the deploy and the unit went red.
+SuccessExitStatus=78
 RestartPreventExitStatus=78
 RestartSec=5