Wire breadlock to the bread event bus (app id lock)

Emit bread.lock.locked when ext-session-lock-v1 is accepted and
bread.lock.unlocked after PAM success. Fail-silent if breadd is down.
No command verbs (no pin/blur stubs). breadgreet is not on the bus.

Note that Forgejo Arch registry packages are unsigned (SigLevel=Never
on BOS) without changing the package.yml registry.

.forgejo/workflows/package.yml

@@ -7,6 +7,10 @@ on:
 jobs:
   package:
     runs-on: [self-hosted, hestia]
+    # Forgejo's Arch package registry does not GPG-sign packages for pacman.
+    # BOS therefore uses SigLevel=Never on [Breadway.os.git.breadway.dev]
+    # until a signed repo exists. Keep publishing here — do not flip this
+    # job to a different registry just to get signatures.
     container:
       image: archlinux:latest
     steps: