docs: add Parallel Execution Lanes section to roadmap

Captures which remaining phases are parallel-safe and which must stay
sequential. Four lanes (3 / 4+5 / 6 / 7) can land in any order right after
Phase 2 because they touch disjoint file trees: daemon/src/fido,
daemon/src/policy_apply + lockout, pam/*.c, and cli/src.

Documents practical caveats: Phase 4+5 must land together (shared SetPolicy
path), Phase 6 is the only C lane and needs libpam0g-dev, and the Phase 1
subagent-worktree cwd quirk should be retested before relying on it for
literal parallel-compute execution.

docs/plans/2026-04-26-authforge-implementation.md

@@ -41,6 +41,99 @@
 
 Total rough estimate: ~14 weeks of focused work for v1.0. Subsequent phases (Debian packaging, KDE port, RPM) are scoped in the design doc.
 
+---
+
+## Parallel Execution Lanes
+
+The phase numbering is a dependency-respecting ordering, **not** a serial schedule. Multiple phases touch disjoint file trees and can be developed in parallel by independent contributors, subagents in worktrees, or a single session bouncing between lanes.
+
+```
+                                Phase 0  ✅ scaffold
+                                   │
+                                Phase 1  ✅ D-Bus contract
+                                   │
+                                Phase 2  ✅ storage layer
+                                   │
+            ┌──────────┬───────────┼───────────┬──────────┐
+            │          │           │           │          │
+        Phase 3    Phase 4+5    Phase 6     Phase 7     (Phase 15: anytime)
+       FIDO2       policy+      PAM C       CLI         (Phase 18: anytime)
+       backend     lockout      module      authforgectl
+            │          │           │           │
+            ↓          ↓           ↓           ↓
+            └──────┬───┘           │           │
+                   ↓               │           │
+          ┌───────────┐            │           │
+       Phase 8    Phase 9       (Phase 12     Phase 16
+       GUI keys   GUI policy   recovery)     Ansible
+          │          │            │           │
+          └──────────┼────────────┘           │
+                     ↓                        │
+                Phase 10                      │
+                first-login                   │
+                     │                        │
+                     └────────────┬───────────┘
+                                  ↓
+                              Phase 13
+                              deb finalization
+                                  ↓
+                              Phase 14
+                              Launchpad PPA
+                                  ↓
+                              Phase 17
+                              integration tests
+                                  ↓
+                              Phase 18
+                              user docs
+                                  ↓
+                                  R
+                              v1.0 release
+```
+
+### Parallelizable now (post-Phase 2)
+
+Four lanes touch disjoint file trees and can land in any order:
+
+| Lane | Phases | Touches | Why parallel-safe |
+|---|---|---|---|
+| **A: FIDO2 backend** | 3 | `daemon/src/fido/`, small `dbus.rs` hook for signals | Self-contained; only consumes the storage façade from Phase 2. |
+| **B: Policy + lockout** | 4 + 5 (must land together) | `daemon/src/policy_apply/`, `daemon/src/lockout/`, `dbus.rs` SetPolicy path | 5 gates 4 in the same call chain, so they go as one unit, but the unit doesn't touch FIDO2, PAM, or CLI. |
+| **C: PAM module** | 6 | `pam/pam_authforge_pending.c` + `Makefile` | Pure C against the JSON-pending-flag contract Phase 2 already writes. Zero overlap with Rust code. |
+| **D: CLI** | 7 | `cli/src/` | The D-Bus contract was settled in Phase 1; CLI is a thin client. |
+
+### Parallelizable in second wave (after first wave's lanes land)
+
+- **Phase 8** (GUI Keys tab) — opens after Lane A (Phase 3) lands. Needs real enrollment for the demo.
+- **Phase 9** (GUI Policy tab) — opens after Lane B (Phase 5) lands. Needs the lockout simulator for the warning banner.
+- **Phase 11** (TOTP, feature-flagged) — opens after Lane B. Independent of Phases 8/9.
+- **Phase 12** (Recovery flow) — opens after Lane C (Phase 6). Independent of GUI lanes.
+- **Phase 16** (Ansible role) — opens after Lane D (Phase 7). Independent of everything else.
+
+### Third wave (single dependency)
+
+- **Phase 10** (first-login flow) — needs Phase 6 (PAM backstop) + Phase 8 (GUI fullscreen). Cannot parallelize earlier.
+
+### Always-anytime slots
+
+- **Phase 15** (`authforge-gnome-integration` shim) — pure data deb; can be built whenever there's idle capacity.
+- **Phase 18** (user docs) — best authored alongside their phase, but writing can start whenever a feature stabilizes.
+
+### Sequential tail (no parallelism wins)
+
+- **Phase 13** (deb finalization) needs all binaries built.
+- **Phase 14** (PPA) needs Phase 13.
+- **Phase 17** (integration test harness) needs end-to-end binaries from at least one PPA build.
+- **R** (release tag) is last.
+
+### Practical notes for executing this in parallel
+
+- Subagents in `git worktree` is the canonical isolation mechanism, but Phase 1 hit a harness `cwd` quirk that broke worktree-based subagents. Re-test before relying on it; otherwise batch independent lanes in a single session.
+- Phase 4 + Phase 5 must land in the same change because both modify the SetPolicy path; splitting them creates a window where SetPolicy applies without a lockout pre-check.
+- Phase 8 (GUI) requires `libgtk-4-dev` + `libadwaita-1-dev` on the dev box. Treat it as its own physical build environment.
+- Phase 6 (PAM C) requires `libpam0g-dev`. Build is a one-line `make -C pam`; no Rust toolchain involvement.
+
+---
+
 ### Phase 1 closeout notes (2026-04-27)
 
 Phase 1 expanded to step granularity at [2026-04-26-phase-1-dbus.md](2026-04-26-phase-1-dbus.md). Code-side work is done; some acceptance gates require an Ubuntu desktop with libgtk-4-dev / libadwaita-1-dev / libfido2-dev / libpam0g-dev installed (see [BUILDING.md](../BUILDING.md)) and are deferred to a smoke pass before Phase 14 (PPA build).