Fix smoke test JSON parsing and set unattended defaults

systemd/pikit-firstboot.sh

@@ -15,6 +15,7 @@ WEB_ASSETS="/var/www/pikit-web/assets"
 PROFILE_FILE="/etc/pikit/profile.json"
 MOTD_FILE="/etc/motd"
 FIRSTBOOT_CONF="/etc/pikit/firstboot.conf"
+APT_UA_OVERRIDE="/etc/apt/apt.conf.d/51pikit-unattended.conf"
 
 STEPS=(
   "Preparing system"
@@ -48,6 +49,28 @@ skip_updates() {
   return 1
 }
 
+configure_unattended_defaults() {
+  if [ -f "$APT_UA_OVERRIDE" ]; then
+    log "Unattended-upgrades config already present; skipping defaults."
+    return
+  fi
+  if ! command -v python3 >/dev/null 2>&1; then
+    log "python3 missing; skipping unattended-upgrades defaults."
+    return
+  fi
+  PYTHONPATH=/usr/local/bin python3 - <<'PY'
+import sys
+try:
+    from pikit_api.auto_updates import set_updates_config
+except Exception as e:
+    print(f"pikit_api unavailable: {e}")
+    sys.exit(0)
+
+set_updates_config({"enable": True, "scope": "security"})
+PY
+  log "Unattended-upgrades defaults applied (security-only)."
+}
+
 write_state() {
   local state="$1"
   local current="$2"
@@ -236,6 +259,7 @@ fi
 finish_step 3
 
 begin_step 4
+configure_unattended_defaults
 if [ -f "$PROFILE_FILE" ] && command -v ufw >/dev/null 2>&1; then
   python3 - <<'PY' > /tmp/pikit-profile-ports.txt
 import json