Detect Elan match-on-chip fingerprint readers again (#6578)

* Detect Elan match-on-chip fingerprint readers again

Elan readers report "ELAN:ARM-M4" as their product string, so the
*fingerprint* and *biometric* checks miss them. Elan's 04f3 is also left
out of the vendor list on purpose, because Elan makes touchscreens too.
Both checks fail, so the machine looks like it has no reader.

Add "elan:arm-m4" to the product string check. The comment above the
vendor list already says the excluded vendors should still match there,
so this makes that true. The vendor list and its has_kernel_driver guard
are unchanged, and touchscreens still cannot cause a false positive.

The string is a family name, not one device. libfprint uses it for
04f3:0c9c and 04f3:0ca7 as well as 04f3:0ca8.

Tested on an HP EliteBook X G2i with 04f3:0ca8.

* Point the Elan comment at the vendor list above it

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Configure PAM only after a fingerprint enrolls and verifies

Detection proves a reader is present, not that libfprint can drive it.
Elan MOC sensors outside the elanmoc table pass the gate and then fail
to enroll, which left pam_fprintd in the sudo and polkit stacks with no
print to match.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/omarchy-hw-fingerprint

@@ -30,7 +30,10 @@ for dev in /sys/bus/usb/devices/*; do
   if [[ -r $dev/product ]]; then
     product=$(<"$dev/product")
     product=${product,,}
-    [[ $product == *fingerprint* || $product == *biometric* ]] && exit 0
+    # Elan's match-on-chip readers report "ELAN:ARM-M4", the family name
+    # rather than the function. Elan is left out of the vendor list above
+    # on purpose, so without this they match nothing.
+    [[ $product == *fingerprint* || $product == *biometric* || $product == *elan:arm-m4* ]] && exit 0
   fi
 
   if [[ -r $dev/idVendor ]]; then

bin/omarchy-setup-security-fingerprint

@@ -83,9 +83,6 @@ fi
 
 omarchy-pkg-add libfprint fprintd usbutils
 
-# Configure PAM
-setup_pam_config
-
 # Enroll first fingerprint
 echo -e "\e[32m\nLet's setup your right index finger as the first fingerprint.\e[0m"
 echo -e "Keep moving the finger around on sensor until the process completes.\n"
@@ -96,6 +93,12 @@ if sudo fprintd-enroll "$USER"; then
   # Verify
   echo -e "\nNow let's verify that it's working correctly.\n"
   if fprintd-verify; then
+    # PAM comes last, once a print is enrolled and verified. Detection only
+    # proves a reader is there, not that libfprint can drive it — an Elan MOC
+    # sensor outside the elanmoc table gets this far and then fails to enroll.
+    # Editing the stacks up front would leave those machines pointing at
+    # pam_fprintd with nothing to match.
+    setup_pam_config
     setup_lock_fingerprint_pam
     echo -e "\e[32m\nPerfect! Fingerprint authentication is now configured.\e[0m"
     echo "You can use your fingerprint for sudo, polkit, and lock screen (Super + Ctrl + L)."