Install libfprint-git for every fingerprint reader

[powderluv]

Fingerprint setup installs the omarchy repo's libfprint-git for every reader in place of stock libfprint, in one --ask 4 transaction so the conflict with stock libfprint is accepted without a separate removal step, and skips pacman entirely when the packages are already installed. Stock libfprint lags upstream on new readers such as the Synaptics 06cb:010b, and libfprint-git is pinned to a fixed upstream commit in omarchy-pkgs, so a new reader is enabled by bumping that pin alone. The migration that used to swap libfprint-git back to stock now only repairs a machine its old two-step form left with fprintd and no library.

Depends on omacom/omarchy-pkgs#321 being merged and published first, since the pin currently served on all three mirrors predates libfprint 1.94.100.

Maintainer note: the scope changed during review from an edge-only channel gate to installing libfprint-git everywhere. The original description follows.

---

Fingerprint setup currently replaces libfprint-git with stock libfprint, undoing support for the Synaptics fingerprint reader 06cb:010b. Select libfprint-git on edge and development builds, while stable and RC continue to select stock libfprint.

Depends on omacom/omarchy-pkgs#321 being merged and its package published to edge. Require at least 1:1.94.100.r10.g6f9479c-1 in the package repository before changing any installed packages, so the older edge pin cannot silently be installed. Replace the conflicting drivers and install fprintd/usbutils in a single pacman transaction using --ask 4, following the existing channel-switching pattern. Enrollment and verification still precede PAM configuration.

This integrates the package into the optional fingerprint setup flow on nightly/edge builds; it does not install fingerprint packages on every machine or switch users' release channels.

Validation:

• Focused tests pass for edge/dev and stable/RC/unknown selection, the minimum and newer versions, missing/old repository packages, failed installation, and missing hardware. Privileged calls are stubbed, and failed enrollment cannot write PAM configuration.
• bash -n and git diff --check pass.
• ./test/all: CLI suite passed; 221 of 225 shell test files passed. Failures were in unchanged bin-style-test.sh (existing raw command checks), launch-about-test.sh (animation assertion), network-qr-test.sh, and snapper-test.sh (missing sibling omarchy-iso checkout). The new fingerprint test passed. These failures are outside this PR's two changed files.
• The companion package PR records 131 passing libfprint tests and successful detect/open/close checks for Synaptics 06cb:010b. Enrollment and end-to-end authentication remain untested.

[dhh]

Pushed a follow-up commit (f76ed15) after review. The gate moved from the release channel to the reader itself:

• New hidden omarchy-hw-fingerprint-git returns true when a reader that stock libfprint 1.94.100 cannot drive is on the bus (currently Synaptics 06cb:010b, as a USB ID table). The wizard installs omarchy/libfprint-git only for those readers, on any channel, and stock libfprint for everyone else. Channel gating blocked every edge/dev user until omarchy-pkgs#321 publishes, and omarchy-channel-current reports dev for any linked checkout even on the stable mirror.
• The version floor stays, but the query and install are qualified with the omarchy repo so a custom repo listed above [omarchy] cannot satisfy or supply the package, and pacman's not-found error no longer leaks.
• pacman is skipped entirely when the driver, fprintd and usbutils are already installed at a sufficient version, so a rerun to enroll another finger cannot become a partial upgrade against a newer sync db.
• Migration 1785090473 keeps libfprint-git on machines with such a reader; before, any account without its marker would have reverted the driver this PR installs. The half-finished-swap recovery still runs.
• The test now runs the real detectors against a sysfs fixture with per-call env instead of leaked exported globals, stubs fprintd-verify, and covers the installed/current/upgrade cases. Separate tests cover the new hardware check and the migration.

— 🤖 Claude, posting on behalf of @dhh

[dhh]

Simplified further on @dhh's call: libfprint-git is now the driver for every reader, on every channel. Pushed as 140cd36 on top of the earlier follow-up.

• The wizard installs libfprint-git fprintd usbutils unconditionally in one --ask 4 transaction, skipped when all three are already present. No channel check, no USB ID table, no version floor. New readers reach users by bumping the pin in omarchy-pkgs.
• omarchy-hw-fingerprint-git and its test are gone.
• Migration 1785090473 no longer swaps anything. It is kept as a repair for the one state its old two-step form could leave behind, fprintd with no library, and installs libfprint-git there.
• The package test shrinks to five cases: fresh install, stock replaced without a removal step, rerun skips pacman, failed install stops before enrollment, no reader does nothing.

Merge order: omacom/omarchy-pkgs#321 first and let it publish, since the pin currently on all three mirrors is a pre-1.94.100 snapshot. Both packages ride the same release train to rc and stable, so no further gating is needed.

I retitled the PR to match; the original description is preserved below the maintainer note.

— 🤖 Claude, posting on behalf of @dhh