Not sure how it ever worked without correct order...

Wants=multi-user.target made the cip-installer deadlock

newer systemd versions use %T as a variable for $TMPDIR, so escape the
percent sign properly.

according to the rules for the libusb/voti shared vendor and product ids, this
must also be matched.

we start a udevadm trigger run somewhen after boot, which doesn't run
rules with ACTION=add but instead ACTION=change. that way our rule would
no longer match, and our device would be chowned away. now we always
match and keep our usb device :-)

otherwise move isn't atomic if /tmp is a different filesystem