desktop: replace ly with greetd autologin + boot-locked quickshell

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

settings/quickshell.nix

@@ -198,6 +198,7 @@ in
           onChange = qsRestart;
           text = ''
             import Quickshell
+            import Quickshell.Io
             import Quickshell.Wayland
             import Quickshell.Services.Pam
             import QtQuick
@@ -225,6 +226,16 @@ in
                     pam.start();
                 }
 
+                // greetd autologs us in, so lock as soon as the shell comes up:
+                // the lockscreen is the login prompt. mkdir is the atomic
+                // once-per-session test — XDG_RUNTIME_DIR dies with the
+                // session, so quickshell restarts (rebuilds) don't re-lock.
+                Process {
+                    running: true
+                    command: ["mkdir", Quickshell.env("XDG_RUNTIME_DIR") + "/qs-boot-lock"]
+                    onExited: code => { if (code === 0) lock.locked = true; }
+                }
+
                 PamContext {
                     id: pam
                     // NixOS ships a "login" pam service; pam_unix verifies the