Addresses the deep codebase audit:
- Center the static wallpaper cover-fit crop so the software (wl_shm)
path agrees with the GPU path and the greeter, instead of anchoring
the crop top-left.
- Desktop-entry Exec tokenizer: respect single quotes and proper
backslash escaping per the freedesktop spec.
- Greeter: dispatch CancelSession whenever the UI resets to the
username stage so the error path can't leave greetd holding a stale
PAM conversation; add a per-roundtrip timeout so a wedged greetd peer
can't strand the "Working" spinner.
- start_locker: return an error instead of spawning a child that
expect()-panics when WAYLAND_DISPLAY is unset.
- Bound in-flight PAM checks with a concurrency cap, since libpam
cannot be cancelled and a stuck module would otherwise leak one
uncancellable thread per retry.
- Expand unit/regression tests (157 total): tokenizer edge cases and a
pseudo-fuzz, blit offset/clamp cases, horizontal+vertical cover
centering, greetd roundtrip-timeout and connection-recovery.
- Reformat the workspace to rustfmt-clean and add a Forgejo CI gate
(fmt --check, clippy -D warnings, all-target tests, locked release
build) — previously the only workflow was an Arch package builder.
