feat: advance login workflow and integration gates

Makefile

@@ -48,6 +48,7 @@ RED :=
 endif
 
 .PHONY: all deps build release-build test check fmt lint doc audit docker-test \
+        integration-test system-e2e system-e2e-strict \
         package release release-check version install uninstall clean run-preview \
         legacy-build legacy-check enable update help
 
@@ -94,6 +95,15 @@ check: fmt test lint doc ## Run the complete local verification gate
 docker-test: ## Run the pinned Docker verification suite
 	@./scripts/test-docker.sh
 
+integration-test: build ## Exercise safe, non-authenticating CLI paths
+	@./scripts/test-cli.sh '$(BUILD_DIR)/$(BINARY)'
+
+system-e2e: ## Probe PAM, VT, X11, Wayland, and logind without requiring privileges
+	@./scripts/test-system-e2e.sh '$(BUILD_DIR)/$(BINARY)'
+
+system-e2e-strict: ## Require all real login-manager capabilities (prepared VM only)
+	@./scripts/test-system-e2e.sh --strict '$(BUILD_DIR)/$(BINARY)'
+
 release-check: ## Validate a release version and optional tag
 	@[[ '$(VERSION)' =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$$ ]] || { echo 'invalid VERSION: $(VERSION)'; exit 1; }
 	@cargo_version="$$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)"; \
@@ -125,7 +135,7 @@ package: release-check build ## Create a deterministic install archive and check
 			'$(PACKAGE_FILE)' "$$checksum" '$(VERSION)' > '$(DIST_DIR)/release.env'
 	@printf '$(GREEN)created$(RESET) %s\n' '$(PACKAGE_FILE)'
 
-release: check audit docker-test package ## Run all gates and produce release artifacts
+release: check audit integration-test system-e2e docker-test package ## Run all gates and produce release artifacts
 
 install: build ## Install the binary, config, PAM policy, and systemd unit
 	@install -Dm755 '$(BUILD_DIR)/$(BINARY)' '$(BINDIR)/$(BINARY)'