### What happened

`omarchy-setup-security-fingerprint` configures fingerprint auth in three
places: `/etc/pam.d/sudo`, `/etc/pam.d/polkit-1`, and
`/etc/pam.d/omarchy-lock-fingerprint` (used by the Quickshell lock screen,
`shell/plugins/lock/Service.qml`).

For sudo and polkit, it inserts a "clamshell gate" ahead of `pam_fprintd.so`:

    auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
    auth sufficient pam_fprintd.so

...which skips fingerprint auth when the lid is closed, since the reader is
physically unreachable, and falls through to the password stack instead.

`setup_lock_fingerprint_pam()` never adds this gate — it writes:

    #%PAM-1.0
    auth       required                    pam_fprintd.so
    account    include                     system-local-login

So the lock screen always calls into `pam_fprintd.so` regardless of lid
state.

On my machine this isn't just a missed optimization: with the lid closed
right after resuming from suspend, the fingerprint sensor was contended
(fprintd logged repeated "Device was already claimed" errors on the
Synaptics reader), and quickshell's 250ms fingerprint retry timer kept
hammering `pam_authenticate()` during that window. One of those calls
crashed the whole shell — `pam_sm_authenticate()` in `pam_fprintd.so`
triggered a jemalloc heap-corruption abort (quickshell links jemalloc
process-wide, so a bad malloc/free anywhere in a PAM module loaded into it
takes the shell down). Confirmed via `coredumpctl` and quickshell's own
crash report in `~/.cache/quickshell/crashes/<id>/report.txt`.

### Expected

The same clamshell gate used for sudo/polkit should also apply to the lock
screen's fingerprint PAM service, so fingerprint auth is skipped (not
attempted) while the lid is closed.

### Fix

Verified this PAM stanza avoids invoking `pam_fprintd.so` at all when the
lid is closed, without weakening the lock screen (this file has no
password fallback of its own — that runs as a separate, parallel PAM
context, `omarchy-lock-password` — so I checked with a standalone libpam
test harness that skipping the only auth line here degrades to a clean
`PAM_PERM_DENIED`, not an accidental `PAM_SUCCESS`):

    #%PAM-1.0
    auth       [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
    auth       required                    pam_fprintd.so
    account    include                     system-local-login

### Steps to reproduce

1. Enroll a fingerprint (`omarchy setup security fingerprint`) on a laptop.
2. Dock/clamshell it (lid closed, external monitor) and suspend/resume, or
   just lock (`omarchy system lock`) with the lid closed.
3. `/etc/pam.d/omarchy-lock-fingerprint` still has no clamshell check, so
   the lock screen calls `pam_fprintd.so` unconditionally.

### System

- Omarchy 4.0.2-1
- fprintd 1.94.5-2, quickshell 0.3.1-1
- Fingerprint reader: Synaptics Sensors (libfprint)

Filed by Claude Sonnet 5 via Claude Code.