Fix audit findings, expand tests, and add a CI quality gate

Addresses the deep codebase audit:

- Center the static wallpaper cover-fit crop so the software (wl_shm)
  path agrees with the GPU path and the greeter, instead of anchoring
  the crop top-left.
- Desktop-entry Exec tokenizer: respect single quotes and proper
  backslash escaping per the freedesktop spec.
- Greeter: dispatch CancelSession whenever the UI resets to the
  username stage so the error path can't leave greetd holding a stale
  PAM conversation; add a per-roundtrip timeout so a wedged greetd peer
  can't strand the "Working" spinner.
- start_locker: return an error instead of spawning a child that
  expect()-panics when WAYLAND_DISPLAY is unset.
- Bound in-flight PAM checks with a concurrency cap, since libpam
  cannot be cancelled and a stuck module would otherwise leak one
  uncancellable thread per retry.
- Expand unit/regression tests (157 total): tokenizer edge cases and a
  pseudo-fuzz, blit offset/clamp cases, horizontal+vertical cover
  centering, greetd roundtrip-timeout and connection-recovery.
- Reformat the workspace to rustfmt-clean and add a Forgejo CI gate
  (fmt --check, clippy -D warnings, all-target tests, locked release
  build) — previously the only workflow was an Arch package builder.

.forgejo/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: ['main']
+
+jobs:
+  check:
+    runs-on: [self-hosted, hestia]
+    # Same container/no-JS-actions convention as package.yml: the archlinux
+    # image has no Node, so every step is a shell command that installs its
+    # own toolchain and clones manually. Keeps the gate identical to how
+    # packages are actually built.
+    container:
+      image: archlinux:latest
+    steps:
+      - name: Install build deps
+        run: |
+          set -euo pipefail
+          pacman -Syu --noconfirm base-devel git rust cargo clippy rustfmt \
+            libgit2 openssl pam wayland libxkbcommon gtk4
+          git config --global --add safe.directory '*'
+
+      - name: Checkout
+        env:
+          BRANCH: ${{ github.head_ref || github.ref_name }}
+        run: |
+          set -euo pipefail
+          # Try the head/ref branch first (e.g. the PR branch); fall back to a
+          # plain default-branch clone so tags/merge refs still check out.
+          git clone --depth 1 --branch "$BRANCH" \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /src \
+            || git clone --depth 1 \
+              "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /src
+
+      - name: Format (rustfmt --check)
+        working-directory: /src
+        run: cargo fmt --all -- --check
+
+      - name: Lint (clippy, warnings as errors)
+        working-directory: /src
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Test (all targets)
+        working-directory: /src
+        run: cargo test --workspace --all-targets
+
+      - name: Build (release, locked)
+        working-directory: /src
+        run: cargo build --release --locked