Implements a C-ABI PAM shared library that registers a pam_set_data cleanup callback to detect auth failures and spawn/kill ahfail-display via a double-fork, without ever touching credentials.
