Fix audit findings, expand tests, and add a CI quality gate

Addresses the deep codebase audit:

- Center the static wallpaper cover-fit crop so the software (wl_shm)
  path agrees with the GPU path and the greeter, instead of anchoring
  the crop top-left.
- Desktop-entry Exec tokenizer: respect single quotes and proper
  backslash escaping per the freedesktop spec.
- Greeter: dispatch CancelSession whenever the UI resets to the
  username stage so the error path can't leave greetd holding a stale
  PAM conversation; add a per-roundtrip timeout so a wedged greetd peer
  can't strand the "Working" spinner.
- start_locker: return an error instead of spawning a child that
  expect()-panics when WAYLAND_DISPLAY is unset.
- Bound in-flight PAM checks with a concurrency cap, since libpam
  cannot be cancelled and a stuck module would otherwise leak one
  uncancellable thread per retry.
- Expand unit/regression tests (157 total): tokenizer edge cases and a
  pseudo-fuzz, blit offset/clamp cases, horizontal+vertical cover
  centering, greetd roundtrip-timeout and connection-recovery.
- Reformat the workspace to rustfmt-clean and add a Forgejo CI gate
  (fmt --check, clippy -D warnings, all-target tests, locked release
  build) — previously the only workflow was an Arch package builder.

breadgreet/src/main.rs

@@ -384,10 +384,9 @@ impl App {
             Stage::Prompt | Stage::Working => {
                 self.status_lbl.set_label("");
                 self.status_lbl.remove_css_class("error");
+                // `reset_to_username` dispatches the CancelSession itself, so
+                // we don't double-send it here.
                 self.reset_to_username();
-                if self.cmd_tx.send(greetd::Command::CancelSession).is_err() {
-                    self.show_error("Cannot reach greetd");
-                }
             }
         }
     }
@@ -416,6 +415,17 @@ impl App {
         self.stage = Stage::Username;
         self.username.clear();
         self.pam_status_held = false;
+        // Abort any greetd conversation still open server-side. Without this,
+        // the error/`show_error` reset path returns to the username entry but
+        // leaves greetd holding a half-done PAM conversation, so the next
+        // login attempt's CreateSession stacks on a stale session. On a
+        // broken channel we set the failure label directly rather than
+        // recursing into `show_error`, which would call back into
+        // `reset_to_username` forever.
+        if self.cmd_tx.send(greetd::Command::CancelSession).is_err() {
+            self.status_lbl.set_label("Cannot reach greetd");
+            self.status_lbl.add_css_class("error");
+        }
         if !self.sessions.is_empty() {
             self.entry.grab_focus();
         }