sessiond: peer pid via getsockopt, and put sessiond under test

UnixStream::peer_cred is still unstable, so it only failed at the aarch64
build after rust-test had gone green. Use the same getsockopt machined
uses.

rust-test never built souveraine-sessiond at all — it is
required-features and the feature is not default. Build and test it.

.gitea/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install system deps
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libasound2-dev libchafa-dev
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq libasound2-dev libchafa-dev libwayland-dev
       # Pinned fork on our Gitea (rgb patch committed there) — upstream HEAD
       # must never decide whether our build passes.
       - name: Clone tuie (pinned fork)
@@ -44,8 +44,19 @@ jobs:
           components: clippy
       - name: cargo test
         run: cargo test
+      # `souveraine-sessiond` is `required-features = ["sessiond"]`, which is
+      # not in `default` — so the line above never compiled the device state
+      # authority, let alone ran its tests. Every sessiond change since the
+      # daemon existed has been type-checked only by the aarch64 cross-build,
+      # which builds and does not test. A green rust-test meant nothing for the
+      # one binary that decides whether the phone is locked. Same trap as the
+      # old primary/public split: a signal that reads like coverage and isn't.
+      - name: cargo test (sessiond)
+        run: cargo test --features sessiond --bin souveraine-sessiond
       - name: cargo clippy
         run: cargo clippy -- -D warnings
+      - name: cargo clippy (sessiond)
+        run: cargo clippy --features sessiond --bin souveraine-sessiond -- -D warnings
 
   no-ai-attribution:
     runs-on: ubuntu-latest