Blank the lock screen while the fingerprint reader waits (#6817)

The blank timer was gated on `authenticating`, which is
`authenticatingPassword || fingerprintAuthenticating`. The fingerprint
PAM sits armed for the entire lock waiting for a finger, so on any
machine with a reader enrolled the gate is true from lock until unlock:
the timer is stopped when the lock begins and never re-armed, and the
display stays lit indefinitely.

Gate on `authenticatingPassword` instead. A password check in flight
still holds the display up, and the passive fingerprint wait no longer
does.


Claude-Session: https://claude.ai/code/session_01EDpyC9793TKZBS2jXUNECG

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

shell/plugins/lock/Service.qml

@@ -424,7 +424,10 @@ Item {
         root.armBlankTimer()
         return
       }
-      if (root.lockRequested && !root.authenticating) root.runBlank()
+      // Only a password check in flight should hold the display up. The
+      // fingerprint PAM stays armed for the whole lock, so gating on
+      // `authenticating` here would keep the panel lit until unlock.
+      if (root.lockRequested && !root.authenticatingPassword) root.runBlank()
     }
   }
 
@@ -472,9 +475,9 @@ Item {
     }
   }
 
-  onAuthenticatingChanged: {
+  onAuthenticatingPasswordChanged: {
     if (!lockRequested) return
-    if (authenticating) idleBlankTimer.stop()
+    if (authenticatingPassword) idleBlankTimer.stop()
     else armBlankTimer()
   }
 

test/shell.d/lock-blank-fingerprint-test.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+run_node_test <<'JS'
+const fs = require('fs')
+const serviceQml = fs.readFileSync(path.join(root, 'shell/plugins/lock/Service.qml'), 'utf8')
+
+// The fingerprint PAM stays armed for the whole lock waiting for a finger, so
+// `authenticating` is true from lock until unlock on every machine with a
+// reader enrolled. Gating the blank on it leaves the panel lit all night.
+assert(
+  /if \(root\.lockRequested && !root\.authenticatingPassword\) root\.runBlank\(\)/.test(serviceQml),
+  'only a password check in flight stops the blank timer from blanking'
+)
+
+assert(
+  !/idleBlankTimer[\s\S]*?!root\.authenticating\)/.test(serviceQml),
+  'the blank timer never gates on the combined authenticating state'
+)
+
+assert(
+  /onAuthenticatingPasswordChanged: \{\s*if \(!lockRequested\) return\s*if \(authenticatingPassword\) idleBlankTimer\.stop\(\)\s*else armBlankTimer\(\)/.test(serviceQml),
+  'the blank timer is held off by password entry and re-armed when it finishes'
+)
+
+assert(
+  !/onAuthenticatingChanged:/.test(serviceQml),
+  'the combined authenticating state no longer drives the blank timer'
+)
+JS