feat: complete session preferences and PAM fixture gates

scripts/test-pam-fixture.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Run ignored PAM fault-injection tests against a disposable service policy.
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "pam-fixture: SKIP (root is required to install a temporary PAM policy)"
+    exit 0
+fi
+
+service="latchd-fixture-$$"
+policy="/etc/pam.d/$service"
+cleanup() {
+    rm -f "$policy"
+}
+trap cleanup EXIT HUP INT TERM
+
+umask 077
+cat >"$policy" <<'PAM'
+# Disposable deny policy used only by the ignored fixture tests.
+auth      required pam_deny.so
+account   required pam_permit.so
+password  required pam_deny.so
+session   required pam_permit.so
+PAM
+
+LATCHD_PAM_FIXTURE_SERVICE="$service" \
+    cargo test --locked -p latchd-auth --test pam_fixture -- --ignored