Observed for real: he closed the window at 21:40:31, a minute after the
deploy. Exit 78, systemd correctly did not restart it, the latch was written
the same second, and rig --ensure reported "CLOSED by hand — leaving it
alone". The whole chain worked on the first real human close.

And then the unit sat in `failed (result: exit-code)`, because
RestartPreventExitStatus only governs the RESTART -- systemd still classifies
a non-zero exit as a failure. So the feature working correctly showed up red
in systemctl, in rig --status, and on the Bridge panel. That is worse than
cosmetic: the next person debugging this rig starts by "fixing" a unit that is
behaving exactly as designed, which is the third time this week something has
sent someone after the wrong layer.

SuccessExitStatus=78 alongside it. The two keys do different jobs and both are
needed: one stops the restart, the other stops the lie.

The test now asserts both keys carry the same number as the code, since the
symptom of drift in either direction looks like a bug somewhere else -- a
window that reappears, or a green unit that reads red.