docs(pam): session gate so GNOME asks for the password at first login, face at unlock

[jeffshee]

What problem does this solve?

A face cannot unlock the GNOME keyring; that needs the login password. With pam_visage
sufficient in gdm-password, the first login after boot succeeds by face and the keyring
immediately asks for the password anyway, so face login buys nothing there while face unlock
of the lock screen is genuinely useful.

GNOME uses the same PAM service, gdm-password, for both the login screen and the lock
screen, so PAM cannot separate the two by service name.

Type

• Documentation
• Other: a pam_exec helper under contrib/pam/

What this changes

contrib/pam/visage-has-session: a ten-line loginctl check that exits 0 when $PAM_USER
already owns a login session (this is an unlock) and 1 otherwise (first login). Used as

auth  [success=ignore default=1]  pam_exec.so quiet /usr/local/libexec/visage-has-session
auth  sufficient                  pam_visage.so

first login falls through to the password stack, which also unlocks the keyring, and face
stays available for unlock. contrib/pam/README.md covers install, test, and the interaction
with a fingerprint reader (GDM runs gdm-password and gdm-fingerprint concurrently; face
belongs in gdm-password only). The operations guide gains a five-line section pointing
there.

Scope: GNOME only. Desktops whose lock screen has its own PAM service do not need this; they
put pam_visage on the unlock service instead. Nothing else has been tested and the docs do
not claim otherwise.

Testing

Fedora 44, GNOME 50, authselect sssd with-fingerprint, Goodix reader enrolled:

• lock screen unlocks by face; fresh login after reboot asks for the password and the keyring
  opens with it;
• PAM_USER=$USER → 0 while logged in, PAM_USER=nobody → 1;
• no SELinux denials (helper is usr_t under /usr/local/libexec, runs only loginctl).

Checklist

• cargo fmt --all -- --check passes
• cargo clippy --workspace -- -D warnings passes
• cargo test --workspace passes
• Commits are signed off (git commit -s) per the DCO
• I have read CONTRIBUTING.md