feat: complete session preferences and PAM fixture gates

scripts/test-system-e2e.sh

@@ -1,9 +1,5 @@
 #!/bin/sh
-# Probe host capabilities needed for a real login-manager deployment.
-#
-# This script never reports an unavailable capability as a pass. On an
-# ordinary container it prints SKIP and exits successfully; --strict turns
-# every SKIP into a failure for a prepared VM or privileged runner.
+# Report unavailable capabilities as SKIP. In strict mode, each SKIP is an error.
 set -u
 
 binary=${1:-}
@@ -47,8 +43,7 @@ else
     skip "latchd binary not supplied; capability-only probe"
 fi
 
-# This is deliberately a runtime capability check, not an authentication
-# claim. Authentication needs a disposable VM user and a test PAM policy.
+# This checks the PAM runtime only. Authentication requires a test account and policy.
 if need_command ldconfig && ldconfig -p 2>/dev/null | grep -q 'libpam\.so'; then
     pass "PAM runtime library is available"
 else
@@ -70,16 +65,14 @@ else
     skip "faillock helper is unavailable"
 fi
 
-# A real VT is a character device and must be allocated by the host/VM. A
-# pseudo-terminal from CI is not equivalent and is intentionally not accepted.
+# A pseudo-terminal does not test VT allocation by the host or VM.
 if [ -c /dev/tty0 ] && [ -d /sys/class/tty/tty0 ]; then
     pass "Linux virtual terminal device is available"
 else
     skip "Linux virtual terminal is unavailable (container or non-console host)"
 fi
 
-# Xvfb is a genuine X server and is safe to exercise without host display
-# access. If it is absent, this is a skip rather than a synthetic success.
+# Xvfb tests X11 without access to the host display.
 if need_command Xvfb; then
     display_number=$((100 + ($$ % 500)))
     display=":$display_number"
@@ -113,8 +106,7 @@ else
     skip "Xvfb is unavailable"
 fi
 
-# A Wayland socket is meaningful only when a compositor owns it. Do not claim
-# Wayland support merely because a client library or executable is installed.
+# A compositor must own the Wayland socket. Installed client libraries are not sufficient.
 wayland_socket=
 if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -n "${XDG_RUNTIME_DIR:-}" ]; then
     case "$WAYLAND_DISPLAY" in
@@ -128,8 +120,7 @@ else
     skip "Wayland compositor socket is unavailable (requires a compositor-backed VM/session)"
 fi
 
-# systemd-logind is not normally PID 1 in a Docker container. loginctl output
-# is checked only when the manager and seat are actually reachable.
+# Check loginctl only when systemd-logind is available.
 if need_command loginctl && [ -d /run/systemd/system ]; then
     if loginctl --no-pager show-seat seat0 >/dev/null 2>&1; then
         pass "systemd-logind seat0 is reachable"