package the sessiond pam file

/etc/pam.d/souveraine-sessiond arrived by hand on 2026-07-16 and is owned
by no package on either device — root-owned config can only arrive by
package. Same rail as souveraine-stepup, plus a bsdtar assertion so a
future drop fails the build instead of shipping quietly. TASK-76.

.gitea/workflows/ci.yml

@@ -415,7 +415,7 @@ jobs:
             fi
             cp packaging/souveraine-verify-trail "$PKG_WORK/"
             cp packaging/souveraine-button "$PKG_WORK/"
-            cp packaging/souveraine-stepup.pam \
+            cp packaging/souveraine-stepup.pam packaging/souveraine-sessiond.pam \
                packaging/org.souveraine.stepup.policy "$PKG_WORK/"
             cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
             (
@@ -429,6 +429,7 @@ jobs:
             bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
             bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-sessiond'
             bsdtar -tf "$PKG" | grep -qx 'usr/lib/systemd/user/souveraine-sessiond.service'
+            bsdtar -tf "$PKG" | grep -qx 'etc/pam.d/souveraine-sessiond'
             if [ "$ARCH" = aarch64 ]; then
               bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-usb-kvm'
             fi

packaging/arch/PKGBUILD.prebuilt

@@ -12,16 +12,17 @@ url="https://gitea.wiuf.net/Fimeg/souveraine"
 license=('MIT')
 depends=('gcc-libs' 'alsa-lib' 'pam')
 options=('!strip')
-backup=('etc/pam.d/souveraine-stepup')
+backup=('etc/pam.d/souveraine-stepup' 'etc/pam.d/souveraine-sessiond')
 source=('souveraine-binary' 'souveraine.service'
         'souveraine-secrets-binary' 'souveraine-secrets.service'
         'souveraine-machined-binary' 'souveraine-machined.service'
         'souveraine-sessiond-binary' 'souveraine-sessiond.service'
+        'souveraine-sessiond.pam'
         'souveraine-verify-trail' 'souveraine-button'
         'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
         'LICENSE')
 sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
-            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
+            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
 # sessiond is built and packaged for both supported architectures. Installing
 # its user unit does not enable or start it; activation remains target-owned.
 if [ "$CARCH" = aarch64 ]; then
@@ -50,6 +51,11 @@ package() {
         "$pkgdir/usr/bin/souveraine-sessiond"
     install -Dm644 "$srcdir/souveraine-sessiond.service" \
         "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
+    # The fallback surface's PAM stack. Root-owned, so package or nothing —
+    # the phone's copy arrived by hand on 2026-07-16, owned by no package, and
+    # had not been touched since (TASK-76).
+    install -Dm644 "$srcdir/souveraine-sessiond.pam" \
+        "$pkgdir/etc/pam.d/souveraine-sessiond"
     # Sensor reporter, aarch64 only — the laptop has no iio-sensor-proxy
     # sources worth reporting and no device state machine listening.
     if [ -f "$srcdir/souveraine-web-binary" ]; then

packaging/souveraine-sessiond.pam

@@ -0,0 +1,5 @@
+# souveraine-sessiond fallback unlock surface.
+# Same stack as console login (the shell's own lock uses quickshell's
+# default "login" service) — the fallback must accept exactly the
+# credentials the real lockscreen accepts, no more, no less.
+auth	include		login