Keep polkit's PAM stack when enabling fingerprint auth

[pelifix]

Arch ships polkit's PAM stack at /usr/lib/pam.d/polkit-1, so /etc/pam.d/polkit-1 does not exist on a stock machine:

$ pacman -Ql polkit | grep pam
polkit /usr/lib/pam.d/polkit-1

The [[ -f /etc/pam.d/polkit-1 ]] test therefore fails and the heredoc fallback runs — not as the rare case it reads like, but as the normal path for anyone setting up a reader. PAM prefers /etc/pam.d, so that file shadows the vendor stack rather than extending it.

The vendor stack is four include system-auth lines. Replacing it with bare pam_unix drops, on a current Arch install:

• pam_faillock preauth/authfail/authsucc (deny=10 unlock_time=120) — no lockout on repeated failed polkit prompts
• pam_env (auth), pam_time (account), pam_limits (session)
• pam_systemd_home on all four stacks

Fix: seed /etc/pam.d/polkit-1 from the vendor file when missing, then let the existing insertion path add the fingerprint lines — the same shape already used for sudo, whose file the sudo package still ships in /etc. The heredoc stays for systems with no vendor file, now including system-auth rather than inventing a stack.

/etc/pam.d/sudo is unaffected; only polkit moved to /usr/lib/pam.d.

Resulting stack on a Latitude 9440:

#%PAM-1.0
auth      [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
auth      sufficient pam_fprintd.so
auth      include   system-auth
account   include   system-auth
password  include   system-auth
session   include   system-auth

./test/cli passes (112 ok).

🤖 Generated with Claude Code