Harden deployment, authentication, firewall and media storage failure paths

scripts/lock-session.sh

@@ -0,0 +1,18 @@
+# Invoked by the fred-lock wrapper, with coreutils, systemd and qs on PATH.
+set -euo pipefail
+
+timeout 5s systemctl --user start quickshell-lock.service
+deadline=$((SECONDS + 10))
+while (( SECONDS < deadline )); do
+    # Select the running service, including one from an older generation.
+    locker_pid=$(timeout 1s systemctl --user show quickshell-lock.service --property=MainPID --value)
+    if [[ "$locker_pid" =~ ^[1-9][0-9]*$ ]] &&
+        timeout 1s qs ipc --pid "$locker_pid" call lock lock >/dev/null 2>&1 &&
+        secure=$(timeout 1s qs ipc --pid "$locker_pid" call lock secure 2>/dev/null) &&
+        [[ "$secure" == true ]]; then
+        exit 0
+    fi
+    sleep 0.1
+done
+echo "The compositor did not confirm a secure session lock" >&2
+exit 1