The display can shut the Orin down: ack first, systemctl poweroff 2 s later.
Refused without --allow-poweroff (only the Orin's unit sets it), without
confirm, or with another boot's boot_id (hello now carries it), so a resend
after the reboot cannot shut the next boot down. polkit grants the service
user logind's power-off; no passwordless sudo involved at runtime.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
