Kill Karabiner-Elements more aggressively at lock screen

So I was hoping that my hack (634d725, "hammerspoon: disable
Karabiner-Elements on sleep") would make my unwanted reboot problem go
away, but today it came back:

    https://wincent.com/snippets/1159

I actually saw the keyboard jam three times today:

1. Jammed while logged in and using the machine. Random mashing of keys
   -- I am not sure exactly what -- made the key repeats go away.
2. The reboot cited above.
3. Another time while logged in and using the machine: this time I
   managed to open the Karabiner-Elements event viewer and confirm that
   Karabiner wasn't even seeing the events, and that quitting Karabiner
   made the issue go away.

In any case, I am going further in this commit, having read the
Karabiner-Elements dev documentation:

    https://github.com/tekezo/Karabiner-Elements/blob/master/docs/DEVELOPMENT.md

this leads me to believe that even though Karabiner-Elements was
disabled by my previous workaround, the fact that karabiner_grabber and
karabiner_observer are still running could be responsible for the
ongoing issues.

Rather than stop using lock screens at all (scary)...

    https://twitter.com/wincent/status/1067501536593539072

I'm reworking my attempted fix to kill the root-owned processes as well.
This requires me to set up sudoers access so that my Hammerspoon
automation can start/stop the processes without user intervention (ie.
no passphrase). Let's cross our fingers and hope this works.

roles/dotfiles/files/.hammerspoon/karabiner.lua

@@ -5,23 +5,14 @@
 
 local log = require 'log'
 
-local trim = (function(s)
-  return s:gsub("(.-)%s*$", "%1")
-end)
-
-local uid = trim(hs.execute('id -u'))
-
 local disable = (function()
   log.i('Disabling Karabiner')
-  hs.execute('launchctl bootout gui/' .. uid .. ' /Library/LaunchAgents/org.pqrs.karabiner.karabiner_console_user_server.plist')
-  hs.execute('launchctl disable gui/' .. uid .. '/org.pqrs.karabiner.karabiner_console_user_server')
+  hs.execute('~/.zsh/bin/karabiner-kill')
 end)
 
 local enable = (function()
   log.i('Enabling Karabiner')
-  hs.execute('launchctl enable gui/' .. uid .. '/org.pqrs.karabiner.karabiner_console_user_server')
-  hs.execute('launchctl bootstrap gui/' .. uid .. ' /Library/LaunchAgents/org.pqrs.karabiner.karabiner_console_user_server.plist')
-  hs.execute('launchctl enable gui/' .. uid .. '/org.pqrs.karabiner.karabiner_console_user_server')
+  hs.execute('~/.zsh/bin/karabiner-boot')
 end)
 
 return {

roles/dotfiles/files/.zsh/bin/karabiner-boot

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# As this script will be called from Hammerspoon where the UID
+# environment variable is not set, grab the UID ourselves here if need be.
+if [ -z "$UID" ]; then
+  UID=$(id -u)
+fi
+
+# Depends on /private/etc/sudoers.d/karabiner-sudoers:
+sudo launchctl load /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_grabber.plist
+sudo launchctl load /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_observer.plist
+
+launchctl enable gui/"$UID"/org.pqrs.karabiner.karabiner_console_user_server
+launchctl bootstrap gui/"$UID" /Library/LaunchAgents/org.pqrs.karabiner.karabiner_console_user_server.plist
+launchctl enable gui/"$UID"/org.pqrs.karabiner.karabiner_console_user_server
+
+echo "🐣 Karabiner-Elements bootstrapped"

roles/dotfiles/files/.zsh/bin/karabiner-kill

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# As this script will be called from Hammerspoon where the UID
+# environment variable is not set, grab the UID ourselves here if need be.
+if [ -z "$UID" ]; then
+  UID=$(id -u)
+fi
+
+launchctl bootout gui/"$UID" /Library/LaunchAgents/org.pqrs.karabiner.karabiner_console_user_server.plist
+launchctl disable gui/"$UID"/org.pqrs.karabiner.karabiner_console_user_server
+
+# Depends on /private/etc/sudoers.d/karabiner-sudoers:
+sudo launchctl unload /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_observer.plist
+sudo launchctl unload /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_grabber.plist
+
+echo "💀 Karabiner-Elements killed"

roles/dotfiles/tasks/main.yml

@@ -53,6 +53,12 @@
     var: karabiner_config
     verbosity: 2
 
+# This is a bit random having this in here, but it's a dependency of our
+# Hammerspoon set-up.
+- name: dotfiles | set up karabiner-sudoers
+  template: dest=/private/etc/sudoers.d/karabiner-sudoers src=karabiner-sudoers
+  become: !!bool yes
+
 # Note some nasty dependencies here between creating the symlinks (eg.
 # effectively creating ~/mutt/config/) and then templating into it (eg.
 # ~/.mutt/config/settings.mutt).

roles/dotfiles/templates/karabiner-sudoers

@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+
+{{ lookup('env', 'USER') }} ALL = NOPASSWD: /bin/launchctl load /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_grabber.plist, /bin/launchctl load /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_observer.plist, /bin/launchctl unload /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_grabber.plist, /bin/launchctl unload /Library/LaunchDaemons/org.pqrs.karabiner.karabiner_observer.plist