release: v0.9.0 pre-release — X11 PAM integration, shadow suppression, macOS cfg guards

- PAM module now correctly fires on failed attempts (must precede auth includes)
- ahfail-display: sprite-sized window replaces full-screen overlay
- ahfail-display: XGrabKeyboard unlock detection replaces process scanning
- ahfail-display: _COMPTON_SHADOW=0 suppresses picom shadow without config changes
- ahfail-display: flock single-instance guard prevents stacking on rapid failures
- X11-specific code guarded behind #[cfg(target_os = "linux")] for macOS builds
- Removed debug logging (dlog/plog) from display and PAM binaries
- README: PAM ordering requirement, supported locker table, roadmap section

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/ahfail-display/Cargo.toml

@@ -12,6 +12,7 @@ gtk = { version = "0.15", package = "gtk", features = ["v3_24"] }
 gdk = { version = "0.15", package = "gdk", features = ["v3_24"] }
 gstreamer = { version = "0.18", package = "gstreamer", features = ["v1_18"] }
 glib = { version = "0.15", package = "glib" }
+cairo = { version = "0.15", package = "cairo-rs" }
 libc = "0.2"
 
 [build-dependencies]