feat: complete session preferences and PAM fixture gates

docs/e2e-testing.md

@@ -5,6 +5,10 @@ Latchd has two test layers:
 * `make integration-test` builds the binary and exercises metadata, TOML
   validation, preflight, and the non-authenticating preview path. It does not
   need PAM credentials, root, a VT, X11, or Wayland.
+* `make pam-fixture-test` installs unique temporary PAM services only when run
+  as root, executes authentication/password-change fault tests and the session
+  metadata/environment handoff tests, then removes the services on exit.
+  Non-root runs report `SKIP`.
 * `make system-e2e` probes the host for PAM, faillock, VT, X11, Wayland, and
   systemd-logind capabilities. Missing capabilities are reported as `SKIP`,
   never as a successful test. Use `make system-e2e-strict` only in a prepared
@@ -22,6 +26,7 @@ For a local release-style run:
 
 ```sh
 make integration-test
+make pam-fixture-test
 make docker-test
 make system-e2e
 ```