[Fail-Safe]

What changed and why

Fixes #259. The factory bypasses the upstream installer step that creates /etc/pam.d/omarchy-lock-password. Quickshell therefore answers missing-pam and refuses to lock; omarchy system lock discards that response, making the menu, shortcut, and command appear to do nothing.

Run the pinned upstream omarchy-apply-lock during factory finalization and require a root-owned, mode-0644 policy before publishing the image. Document sudo omarchy-apply-lock for existing guests, which retain their disk when the Mac app updates. This uses the upstream PAM policy and existing guest password.

Testing

• make test: passed (245 guest tests, 373 Swift tests, shell/integration checks).
• Disposable ARM64/HVF guest: reproduced the missing policy and silent no-op; applying the upstream setup immediately enabled locking without restarting the session.
• Command, keyboard shortcut, and System menu lock actions passed. Verified secure Wayland lock, incorrect-password rejection, correct-password unlock, and repetition after reboot.
• Full ARM64 factory build passed; all nine output checksums verified. The new policy was present as root:root, mode 0644 before first boot.
• Fresh VM booted from that image with passwordPam: true without a repair command. Command, shortcut, and System menu locking passed; wrong passwords remained locked and the correct password unlocked, including after reboot. Test provisioning used upstream owner-provisioning functions with disposable account values.
• CI passed on macOS 15 and macOS 26, including native runtime build/verification.
• Local factory build used the verified package-cache recovery from fix: Stable ARM application repository and existing guest migration #270 and bounded compiler parallelism from fix: limit Hyprland build jobs to the available memory budget #271 as build prerequisites; those changes are excluded from this PR. The rebuilt Hyprland binary retained its pinned SHA-256. Lock-screen screenshot capture returned a blank image; secure session-lock state and PAM authentication were verified directly.

Adendum: Keybinding

The Omarchy default keybinding for locking the system is SUPER + CTRL + L. For those who want to maintain the default macOS keybinding for system lock, you can drop this into your ~/.config/hypr/bindings.lua file:

o.bind("SUPER + CTRL + Q", "Lock system", "omarchy system lock")