feat: complete session preferences and PAM fixture gates

scripts/test-cli.sh

@@ -1,9 +1,5 @@
 #!/bin/sh
-# Exercise the non-interactive CLI contract without authenticating a user.
-#
-# This suite intentionally uses --preview. It validates TOML parsing, command
-# line validation, build metadata, and the preflight path without requiring a
-# PAM secret, a controlling VT, or a running display server.
+# Use --preview so this test does not need PAM, a VT, or a display server.
 set -eu
 
 binary=${1:-target/debug/latchd}