feat: complete session preferences and PAM fixture gates

Makefile

@@ -48,7 +48,7 @@ RED :=
 endif
 
 .PHONY: all deps build release-build test check fmt lint doc audit docker-test \
-        integration-test system-e2e system-e2e-strict \
+        integration-test pam-fixture-test system-e2e system-e2e-strict \
         package release release-check version install uninstall clean run-preview \
         legacy-build legacy-check enable update help
 
@@ -98,6 +98,9 @@ docker-test: ## Run the pinned Docker verification suite
 integration-test: build ## Exercise safe, non-authenticating CLI paths
 	@./scripts/test-cli.sh '$(BUILD_DIR)/$(BINARY)'
 
+pam-fixture-test: ## Run the disposable PAM fault-injection tests when privileged
+	@./scripts/test-pam-fixture.sh
+
 system-e2e: ## Probe PAM, VT, X11, Wayland, and logind without requiring privileges
 	@./scripts/test-system-e2e.sh '$(BUILD_DIR)/$(BINARY)'