Bound lock authentication resource use

[vip32]

Problem

The lock/authentication surface currently relies on limits and lifecycle behavior that are too permissive for a long-running security-sensitive UI:

• The password field has no small application-defined length limit. Its value is mirrored into service state, used to build a matching masked TextMetrics string, retained as pendingPassword, and forwarded to PAM.
• Failed fingerprint authentication schedules another PAM attempt after a fixed 250 ms for as long as the session remains locked.
• Fingerprint authentication and the fprintd-list capability probe have no explicit deadline or recovery path when PAM or fprintd stalls.
• Quickshell emits completed(PamResult.Error) after error, while the current handlers perform failure transitions from both callbacks.

Planned changes

• Add a small explicit password limit at the TextInput boundary so typed and pasted input is bounded before masking and layout work.
• Independently reject and clear oversized input in the lock service before assigning pendingPassword or responding to PAM.
• Add a bounded fingerprint retry policy with capped backoff rather than retrying every 250 ms indefinitely.
• Add watchdog/deadline handling for a stuck fingerprint PAM attempt and the fprintd capability probe.
• Consolidate PAM error completion into one failure transition.
• Preserve password authentication as the recovery path when fingerprint work is exhausted or unavailable.

Testing plan

• Extend the existing lock password overflow fixture with explicit boundary coverage.
• Add headless coverage for service-side rejection, retry budget, backoff, deadline, and recovery behavior.
• Run ./test/shell and ./test/all.
• Manually verify password success/failure, fingerprint success/failure, timeout recovery, screen blanking, and fallback to password in a running Omarchy session.

Status

Draft: analysis is complete; implementation and Omarchy runtime verification are pending.

Fixes #10078

[vip32]

Work on existing draft PR #10082 and issue #10078. Check out fix/10078-lock-auth-resource-bounds, read AGENTS.md, agents/skills/shell-dev.md, and agents/skills/visual-verification.md. Review the PR’s analysis, choose and document sensible resource limits, implement the focused fix with regression tests, run ./test/shell and ./test/all, perform relevant live lock-screen verification, then commit and push to the existing branch. Do not create another PR or mark the current PR ready yet.