Adds /etc/pam.d/greetd to the TARGETS array so re-running
enable-fingerprint.sh extends fprintd auth to the regreet login
screen. Cold-boot timing and silent-touch UX caveats documented
in the spec are accepted as-is — fingerprint failure falls back to
password, no risk of lockout.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>