Stop fprintd before suspend to protect the reader mid-sleep

[surim0n]

Summary

pam_fprintd D-Bus-activates fprintd after PrepareForSleep(true), when logind has already stopped accepting new delay inhibitors. The fingerprint reader can then be cut mid-transaction during suspend. Add a pre sleep hook that stops fprintd before the kernel sleeps.

Fixes #10252.

Change

• Add default/systemd/system-sleep/50-fprintd-release, a pre hook that stops fprintd.service only if active.
• Add migrations/1788797303.sh to copy the hook to /usr/lib/systemd/system-sleep/ on existing installs.
• Update bin/omarchy-setup-security-fingerprint to install the hook when fingerprint auth is set up.
• Add test/shell.d/fprintd-sleep-release-test.sh to cover the hook, migration, and setup wiring.

Notes

• fprintd is Type=dbus, so it re-activates on the next unlock attempt and does not need a post hook.
• The hook uses || true on systemctl stop so a stuck fprintd cannot abort a suspend.

Test plan

• bash test/shell.d/fprintd-sleep-release-test.sh passes
• bash test/shell.d/systemd-test.sh still passes
• git diff --check clean
• Real suspend/resume with fingerprint on a laptop (needs hardware)

Generated with Devin

[surim0n]

Withdrawing this implementation after a closer review. The is-active gate skips fprintd while it is activating, and a one-time stop does not establish the claimed barrier against subsequent D-Bus activation or prove safe device quiescence. The corrected workaround in #10252 is explicitly unverified. #9919 and #8531 address fingerprint activation around sleep more directly; I would rather help validate that work than add an unverified competing hook. This does not mean the underlying issue is resolved.