A seat is hardware; a graphical session is state

Two questions that had been answered by one capability. graphical-session asks
whether a session is running now; seat asks whether one could ever run here.
Assignment needs the second -- a headless server can never have a display
server, a workstation with nothing installed yet can, and until now those
looked identical. The mesh would have assigned xorg to the server and found out
at apply time.

"seat" rather than "display", and the distinction matters most on a phone. An
Android device plainly has a screen and has no seat: nothing there is going to
take a DRM device and present an X or Wayland session on it. A capability
called display would answer yes and be useless. This one answers no, which is
true and useful.

Read from what the kernel reports about its connectors, which distinguishes the
two ways of not having one: a machine with a graphics card and nothing plugged
in is a different thing from a machine with no graphics at all, and somebody
deciding where a desktop goes wants to know which they are looking at.

Verified against this workstation: it reports card1-DP-1 and card1-DP-2, which
are the two monitors actually connected, and ignores the DisplayPort and HDMI
that are not -- and the writeback connector reporting "unknown", which counting
would have handed a seat to machines that have none.

internal/profile/detectors.go

@@ -16,7 +16,10 @@ const (
 	CapFirewall         = "firewall"
 	CapOverlay          = "overlay"
 	CapGraphicalSession = "graphical-session"
-	CapPrivileged       = "privileged"
+	// CapSeat is hardware: somewhere a display server COULD run. CapGraphicalSession above is
+	// state: whether one IS running. Assignment needs the first.
+	CapSeat       = "seat"
+	CapPrivileged = "privileged"
 )
 
 // commandCapability is the shape most detectors take: run something, and treat a working
@@ -172,6 +175,7 @@ func Default(runner Runner) []Detector {
 	return []Detector{
 		privileged{},
 		graphicalSession{},
+		seat{},
 		commandCapability{
 			name: CapContainerRuntime, command: "docker", args: []string{"info", "--format", "{{.ServerVersion}}"},
 			why:    "asks the daemon for its version — a running daemon, not an installed client",