omarchy-setup-security-fingerprint doesn't add the clamshell gate to the lock screen's fingerprint PAM config

[1818TusculumSt]

What happened

omarchy-setup-security-fingerprint configures fingerprint auth in three
places: /etc/pam.d/sudo, /etc/pam.d/polkit-1, and
/etc/pam.d/omarchy-lock-fingerprint (used by the Quickshell lock screen,
shell/plugins/lock/Service.qml).

For sudo and polkit, it inserts a "clamshell gate" ahead of pam_fprintd.so:

auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
auth sufficient pam_fprintd.so

...which skips fingerprint auth when the lid is closed, since the reader is
physically unreachable, and falls through to the password stack instead.

setup_lock_fingerprint_pam() never adds this gate — it writes:

#%PAM-1.0
auth       required                    pam_fprintd.so
account    include                     system-local-login

So the lock screen always calls into pam_fprintd.so regardless of lid
state.

On my machine this isn't just a missed optimization: with the lid closed
right after resuming from suspend, the fingerprint sensor was contended
(fprintd logged repeated "Device was already claimed" errors on the
Synaptics reader), and quickshell's 250ms fingerprint retry timer kept
hammering pam_authenticate() during that window. One of those calls
crashed the whole shell — pam_sm_authenticate() in pam_fprintd.so
triggered a jemalloc heap-corruption abort (quickshell links jemalloc
process-wide, so a bad malloc/free anywhere in a PAM module loaded into it
takes the shell down). Confirmed via coredumpctl and quickshell's own
crash report in ~/.cache/quickshell/crashes/<id>/report.txt.

Expected

The same clamshell gate used for sudo/polkit should also apply to the lock
screen's fingerprint PAM service, so fingerprint auth is skipped (not
attempted) while the lid is closed.

Fix

Verified this PAM stanza avoids invoking pam_fprintd.so at all when the
lid is closed, without weakening the lock screen (this file has no
password fallback of its own — that runs as a separate, parallel PAM
context, omarchy-lock-password — so I checked with a standalone libpam
test harness that skipping the only auth line here degrades to a clean
PAM_PERM_DENIED, not an accidental PAM_SUCCESS):

#%PAM-1.0
auth       [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
auth       required                    pam_fprintd.so
account    include                     system-local-login

Steps to reproduce

1. Enroll a fingerprint (omarchy setup security fingerprint) on a laptop.
2. Dock/clamshell it (lid closed, external monitor) and suspend/resume, or
   just lock (omarchy system lock) with the lid closed.
3. /etc/pam.d/omarchy-lock-fingerprint still has no clamshell check, so
   the lock screen calls pam_fprintd.so unconditionally.

System

• Omarchy 4.0.2-1
• fprintd 1.94.5-2, quickshell 0.3.1-1
• Fingerprint reader: Synaptics Sensors (libfprint)

Filed by Claude Sonnet 5 via Claude Code.