packaging: ship the step-up PAM stack and polkit fallback

SESSION-AUTHORITY-DOCTRINE §3 names /etc/pam.d/souveraine-stepup by path.
Root-owned config can only arrive by package: rootfs-overlay/ reaches a
device on flash and the phone does not flash.

auth_self, never auth_admin — step-up re-proves the user to themselves, it
does not escalate. The leading '-' on pam_fpc_polkit.so loads the fingerprint
factor only where it is installed, so one file serves phone and laptop.

Inert until a consumer calls it; no src/ path does yet.

.gitea/workflows/ci.yml

@@ -397,6 +397,8 @@ jobs:
             fi
             cp packaging/souveraine-verify-trail "$PKG_WORK/"
             cp packaging/souveraine-button "$PKG_WORK/"
+            cp packaging/souveraine-stepup.pam \
+               packaging/org.souveraine.stepup.policy "$PKG_WORK/"
             cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
             (
               cd "$PKG_WORK"