fix: close the update popup instead of racing to prevent it

Blocking snu.lge.com in /etc/hosts never stopped the boot popup on a CX,
and the reason only showed up on the TV itself: /usr/sbin/update is a
systemd unit (webos-mbd.target) that runs its version check against
https://snu.lge.com/CheckSWAutoUpdate.laf 15-20 seconds before the
Homebrew Channel gets as far as running its init.d hooks. The check
therefore succeeds on every boot and the alert is already on screen
before any hosts entry exists. Homebrew Channel's own "block system
updates" toggle loses the same race.

Nothing running that late can win it: every systemd unit path is a
read-only overlay except tmpfs /run, and no persistent setting gates the
check - automaticUpdate, support/softwareUpdateEnable,
hotelMode/swUpdateEnable and .UpdateIsInprogress were each measured by
restarting the daemon and counting its requests.

So dismiss the popup instead. The boot hook recovers the alert id from
the updater's own log (_gAlertWindowId), which is the only way to reach
an alert that opened before we could subscribe - com.webos.notification
never reports it to a late subscriber and closeAllAlerts rejects every
source id it accepts. A companion alert-watch.sh then stays subscribed
for the rest of the session.

Also drop two things that were never true. There is no staged firmware
image driving the popup (the staging dir is empty at boot; the size the
daemon reports is in-memory only), and there is no update service to
stop - /etc/init is dead upstart leftovers on a systemd TV, so the old
stopServices layer printed "stopped update" while doing nothing.

  - rename the hook to 00-lgupdateblocker so run-parts runs it first,
    removing the legacy file on apply
  - add support/ and hotelMode/ to the scanned settings categories
  - stop matching "ota" inside screenRotation, which would have switched
    screen rotation off
  - kill the watcher by process group, and make its TERM trap exit - a
    trap that only returns resumes the script, which then re-subscribes

Verified on an LG OLED55CX8LB (webOS 5, 04.60.65): after a reboot the
boot log records "dismissed update popup
com.webos.service.update-1788650782451", matching the id the updater
logged that boot. Raised 01:26:22, closed 01:26:37 - so it is visible
for ~15s and then goes away on its own.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/description.html

@@ -1,22 +1,29 @@
 <p><b>LG Update Blocker</b> stops the "a new software version is available" popup
 that webOS shows on every boot, without touching the firmware itself.</p>
 
+<p>Blocking the update servers alone does not do it: the updater asks LG about
+new firmware around 20 seconds before the Homebrew Channel gets to run its boot
+hooks, so on a CX the check succeeds every time and the popup is already up.
+Nothing running that late can win the race, so this app closes the popup as
+well as blocking the servers.</p>
+
 <p>It applies up to five reversible layers and re-applies them on every boot
 through a Homebrew Channel startup hook:</p>
 
 <ul>
   <li><b>Block LG update servers</b> - points snu/su/nsu.lge.com and their TLS
-      and CDN aliases at 127.0.0.1 in /etc/hosts.</li>
-  <li><b>Delete staged firmware</b> - wipes /mnt/lg/cmn_data/swupdate. An update
-      that was already downloaded keeps prompting even when the servers are
-      unreachable, which is why blocking alone often is not enough.</li>
+      and CDN aliases at 127.0.0.1 in /etc/hosts, which stops the download and
+      every later check in the session.</li>
+  <li><b>Close the update popup</b> - closes the alert raised during boot, then
+      stays subscribed to the notification manager and closes any later one as
+      it opens.</li>
+  <li><b>Delete staged firmware</b> - wipes /mnt/lg/cmn_data/swupdate should the
+      TV ever manage to download an image.</li>
   <li><b>Lock the staging folder</b> - bind-mounts an empty read-only directory
       over it so nothing can be staged again.</li>
   <li><b>Turn off auto-update settings</b> - switches off every update related
       key that com.webos.settingsservice exposes on your firmware, remembering
       the original values.</li>
-  <li><b>Stop update services at boot</b> - optional, stops the update upstart
-      jobs found on the TV.</li>
 </ul>
 
 <p>Requires root and the Homebrew Channel: the app asks the Homebrew Channel to