Fix Electron binary extraction failing silently during upgrade

Two bugs combined to cause the 'Electron binary download failed' error
even though the zip downloaded and unzip reported inflating all files:

1. The upgrade path called install_electron_binary bare (no ||), so
   set -euo pipefail was active inside the function. Any failing command
   (e.g. chmod on a file that wasn't written) killed the script before
   the error messages printed. Fresh install used || exit 1, which
   disables set -e inside the function body. Upgrade now uses
   || { log_error ...; return 1; } to match.

2. The unzip ran as the kiosk user, but node_modules/electron/dist/ can
   be owned by root when npm's electron postinstall script runs with
   --unsafe-perm. The kiosk user can't write there, so unzip's write
   errors go to stderr (not visible in the log) while inflating: lines
   still appear on stdout. The binary is never actually written.
   Fix: run mkdir/unzip/chmod as root, then chown -R to kiosk.

https://claude.ai/code/session_01VQ13Fwq4MXxwThLfCXBeGr

ubuntu-based-kiosk-v1.0.3.sh

@@ -11099,10 +11099,12 @@ install_electron_binary() {
             tmp_zip=$(mktemp --suffix=.zip)
             if wget --timeout=300 --tries=3 --show-progress -O "$tmp_zip" "$electron_url" 2>&1; then
                 command -v unzip >/dev/null 2>&1 || sudo apt install -y unzip
-                chmod 644 "$tmp_zip"   # mktemp creates root:root 600; kiosk user needs read access
+                # Run as root so we can write regardless of who owns node_modules/electron/dist/
-                sudo -u "$KIOSK_USER" mkdir -p "$KIOSK_DIR/node_modules/electron/dist"
+                # (npm postinstall may create it as root when --unsafe-perm is used)
-                sudo -u "$KIOSK_USER" unzip -o "$tmp_zip" -d "$KIOSK_DIR/node_modules/electron/dist/"
+                mkdir -p "$KIOSK_DIR/node_modules/electron/dist"
-                sudo -u "$KIOSK_USER" chmod +x "$electron_bin"
+                unzip -o "$tmp_zip" -d "$KIOSK_DIR/node_modules/electron/dist/"
+                chown -R "$KIOSK_USER:$KIOSK_USER" "$KIOSK_DIR/node_modules/electron/dist/"
+                chmod +x "$electron_bin"
             fi
             rm -f "$tmp_zip"
         fi
@@ -11305,7 +11307,8 @@ upgrade_kiosk() {
     fi
 
     # Verify and fix Electron binary + chrome-sandbox (same logic as fresh install)
-    install_electron_binary
+    # Use || return 1 to disable set -e inside the function (matches fresh install pattern)
+    install_electron_binary || { log_error "Electron setup failed — upgrade aborted."; return 1; }
 
     # Restore config
     if [[ -f "$config_backup" ]]; then