pam_u2f is set up as a sufficient factor ahead of password for sudo and
login (which greetd/tuigreet substacks), so touching the key logs in
without typing a password while leaving password as fallback.
Fingerprint was investigated too but lauretta's reader is an unsupported
match-on-chip sensor, documented in the feature instead of wired up.
Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default
since they're unused.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
