feat(pkg): ship baseline pam-configs profile (Default: no, pending-flag only)

debian/authforge.pam-config

@@ -0,0 +1,13 @@
+Name: AuthForge first-login backstop
+Default: no
+Priority: 256
+Auth-Type: Primary
+Auth:
+        [success=ok default=die]               pam_authforge_pending.so
+Auth-Initial:
+        [success=ok default=die]               pam_authforge_pending.so
+Account-Type: Primary
+Account:
+        sufficient                              pam_unix.so
+Account-Initial:
+        sufficient                              pam_unix.so

debian/rules

@@ -30,6 +30,10 @@ override_dh_auto_install:
 	    debian/authforge-gui/etc/xdg/autostart/authforge-firstrun.desktop
 	# PAM
 	$(MAKE) -C pam install DESTDIR=$(CURDIR)/debian/authforge-pam
+	# Baseline pam-configs profile for pam-auth-update; daemon overwrites
+	# /usr/share/pam-configs/authforge at runtime when a real policy lands.
+	install -D -m 0644 debian/authforge.pam-config \
+	    debian/authforge-pam/usr/share/pam-configs/authforge
 	# D-Bus activation file
 	install -D -m 0644 debian/io.dangerousthings.AuthForge.service \
 	    debian/authforge-daemon/usr/share/dbus-1/system-services/io.dangerousthings.AuthForge.service