Document the hybrid GPU renderer and fix packaging

README claimed fully software / no EGL; the locker is GLES2 wallpaper
plus software chrome, with opt-in Ken Burns. Building needs git and
pkg-config. PKGBUILD pkgver matches 0.2.0, backs up /etc/pam.d/breadlock,
and notes both dev bins. Release CI runs check() instead of --nocheck.

.forgejo/workflows/package.yml

@@ -34,8 +34,7 @@ jobs:
           sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/arch/PKGBUILD
           sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/arch/PKGBUILD
           chown -R builder:builder /home/builder/src
-          # --nocheck: packaging builds the artifact; tests belong in a CI job.
+          su builder -c "cd /home/builder/src/packaging/arch && makepkg -f --noconfirm"
-          su builder -c "cd /home/builder/src/packaging/arch && makepkg -f --noconfirm --nocheck"
           PKG=$(find /home/builder/src/packaging/arch -name '*.pkg.tar.zst' | head -1)
           mkdir -p /tmp/breadlock-pkg
           cp "$PKG" /tmp/breadlock-pkg/

README.md

@@ -30,15 +30,15 @@ breadlock/
 ├── breadlock-ui/   shared: bread-theme wrapper, TOML config, .desktop parsing,
 │                    software-rendering primitives (tiny-skia + cosmic-text,
 │                    behind the "paint" feature — only breadlock needs them)
-├── breadlock/       the locker (SCTK + PAM)
+├── breadlock/       the locker (SCTK + PAM; EGL wallpaper + software chrome)
 └── breadgreet/      the greeter (GTK4 + relm4 + greetd_ipc)
 ```
 
 ### breadlock
 
 - **Protocol**: `ext-session-lock-v1` via [`smithay-client-toolkit`](https://docs.rs/smithay-client-toolkit) — GTK has no session-lock support, so this is a raw Wayland client, not a layer-shell surface like breadbar.
-- **Rendering**: fully software — `tiny-skia` composites each frame (background, rounded password pill, clock, status line) into a `wl_shm` buffer; `cosmic-text` shapes and rasterizes text (loads "Varela Round" by family name). No EGL/GL.
+- **Rendering**: hybrid — wallpaper via EGL/GLES2 (`wl_egl_window` wrapping the lock surface); chrome (password pill, clock, status line) is still software (`tiny-skia` + `cosmic-text`, "Varela Round" by family name) and blitted over the GPU frame. If EGL init fails, the locker falls back to a fully-software `wl_shm` path.
-- **Background**: a solid palette color or a static PNG (cover-fit). `background.blur` is **not implemented** — the key is accepted and logs a warning; the surface is drawn unblurred. Live blur-of-desktop (hyprlock-style) would need a `wlr-screencopy` capture.
+- **Background**: a solid palette color or a PNG (cover-fit). Ken Burns (`background.ken_burns`) is opt-in: a slow pan+zoom on image backgrounds — cheap on the GPU path, a continuous software redraw if EGL is unavailable. `background.blur` is **not implemented** — the key is accepted and logs a warning; the surface is drawn unblurred. Live blur-of-desktop (hyprlock-style) would need a `wlr-screencopy` capture.
 - **Auth**: [`pam-client2`](https://crates.io/crates/pam-client2) against the `breadlock` PAM service (`packaging/pam.d/breadlock`, installed to `/etc/pam.d/breadlock` by the package). Runs on its own OS thread — libpam's conversation callback is blocking FFI — and reports back through a `calloop::channel` registered on the render loop.
 
 ### breadgreet
@@ -51,6 +51,8 @@ breadlock/
 
 Copy [`breadlock.example.toml`](breadlock.example.toml) to `~/.config/breadlock/breadlock.toml` and [`breadgreet.example.toml`](breadgreet.example.toml) to `/etc/greetd/breadgreet.toml` (or `~/.config/breadgreet/breadgreet.toml` for local testing under a normal session — `breadgreet` checks the system path first since it typically runs as the dedicated `greeter` user). Every field is optional; both binaries run with sensible defaults and no config at all.
 
+`breadlock.toml`'s `[status]` table (both flags default on) shows now-playing (MPRIS) and battery (upower) as a small line under the clock. Polled on a background thread; degrades silently if D-Bus or the service is missing.
+
 ## Building
 
 ```sh
@@ -58,13 +60,13 @@ cargo build --release --bin breadlock --bin breadgreet
 cargo test --workspace
 ```
 
-Requires GTK4 (≥ 4.12), `libxkbcommon`, and PAM development headers. On Arch:
+Requires GTK4 (≥ 4.12), `libxkbcommon`, PAM development headers, `git` (workspace crates `bread-theme` / `bread-utils` are git deps), and `pkg-config` (gtk4-rs; also provided by `base-devel`). On Arch:
 
 ```sh
-sudo pacman -S gtk4 wayland libxkbcommon pam rust cargo
+sudo pacman -S gtk4 wayland libxkbcommon pam rust cargo git pkg-config
 ```
 
-`breadlock-auth-check` is a third, dev-only binary in the `breadlock` package (see Verification below) — not installed by the package, build it explicitly with `cargo build --bin breadlock-auth-check` if you need it.
+`breadlock-auth-check` and `breadlock-preview` are extra, dev-only binaries in the `breadlock` package (see Verification below) — not installed by the package. Build them explicitly with `cargo build --bin breadlock-auth-check` or `--bin breadlock-preview` if you need them.
 
 ## Packaging
 

packaging/arch/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Breadway <plasticbread849@gmail.com>
 
 pkgname=breadlock
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="Session locker and greetd greeter for Hyprland / Wayland"
 arch=('x86_64')
@@ -15,15 +15,18 @@ depends=('pam' 'wayland' 'libxkbcommon' 'gtk4')
 optdepends=(
   'cage: minimal Wayland compositor to host breadgreet under greetd'
   'hyprland: the session breadlock protects and breadgreet launches'
+  'upower: battery line on the lock screen'
 )
 makedepends=('rust' 'cargo')
+backup=('etc/pam.d/breadlock')
 source=("${pkgname}-${pkgver}.tar.gz")
 sha256sums=('SKIP')
 
 build() {
   cd "${srcdir}/${pkgname}-${pkgver}"
   # --bin (not -p breadlock) deliberately excludes the breadlock-auth-check
-  # dev harness, which shares the breadlock package but isn't installed.
+  # and breadlock-preview dev harnesses, which share the breadlock package
+  # but aren't installed.
   cargo build --release --locked --bin breadlock --bin breadgreet
 }