fix(greetd): pin greeter GPU + software cursors + single-output centering

Diagnosed the intermittent "login won't take input / frozen cursor" on this
dual-AMD-GPU box: cage (wlroots) could pick the display-less iGPU, and amdgpu
hardware cursors can freeze. regreet-session.sh now:
- pins WLR_DRM_DEVICES to the first DRM card with a connected output (portable,
  evaluated live — no hard-coded PCI path),
- sets WLR_NO_HARDWARE_CURSORS=1 (fixes the stuck cursor),
- runs cage with `-m last` so the login card centres on a single monitor instead
  of the default "extend", which stretched the canvas across all three monitors
  and left the card floating in the middle of the span.

sysupdate.sh now deploys /etc/greetd config (config/regreet/session, not PAM) when
greetd is the active greeter, using the single primed sudo credential.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SUN7gg6GGfnToghMijLm5Y

etc-greetd/regreet-session.sh

@@ -3,7 +3,7 @@
 #
 # greetd runs this as the unprivileged `greeter` user. cage is a minimal
 # wlroots/Wayland compositor; `-s` allows VT switching (so Ctrl+Alt+F-keys still
-# reach a console). Env here tunes the greeter's look before ReGreet starts.
+# reach a console). Env here tunes the greeter's look/behaviour before ReGreet starts.
 #
 # Scaling: cage renders at output scale 1. Bump XCURSOR_SIZE for a larger cursor;
 # uncomment GDK_SCALE to integer-scale the whole greeter (careful on mixed-DPI
@@ -13,4 +13,22 @@
 export XCURSOR_SIZE=32
 # export GDK_SCALE=2
 
-exec cage -s -- regreet
+# ── Multi-GPU: pin the greeter to a DRM card that actually drives a monitor ─────
+# On a dual-GPU box (dGPU + iGPU) wlroots enumerates both cards and may pick the
+# display-less one, giving a blank or input-frozen greeter. Hand it only the first
+# card that has a connected output. Evaluated live, so it stays portable across
+# boots and machines (no hard-coded PCI path).
+for _status in /sys/class/drm/card[0-9]*-*/status; do
+    [ "$(cat "$_status" 2>/dev/null)" = "connected" ] || continue
+    _card="/dev/dri/$(basename "$(dirname "$_status")" | cut -d- -f1)"
+    [ -e "$_card" ] && { WLR_DRM_DEVICES="$_card"; export WLR_DRM_DEVICES; break; }
+done
+
+# amdgpu hardware cursors can freeze on this hardware (the cursor sticks and input
+# feels dead); software cursors are reliable.
+export WLR_NO_HARDWARE_CURSORS=1
+
+# cage's default is "-m extend", which stretches one canvas across every monitor and
+# leaves ReGreet's login card floating in the middle of the whole multi-monitor span.
+# "-m last" renders on a single output instead, so the card is centred on one screen.
+exec cage -s -m last -- regreet

sysupdate.sh

@@ -597,12 +597,29 @@ _fix_hypr_usr() {
     fi
 }
 
+# Deploy root-owned greeter config (/etc/greetd) that config-updater can't reach.
+# Only when greetd is the active greeter on this machine. Uses the sudo credential
+# primed once at startup, so it doesn't re-prompt. PAM is intentionally left to the
+# setup module — a bad PAM file could lock out login.
+_deploy_greetd() {
+    local src="$DOTFILES/etc-greetd"
+    [[ -d "$src" ]] || return 0
+    systemctl is-enabled greetd.service &>/dev/null || return 0
+    log "Deploying greetd / ReGreet config to ${BO}/etc/greetd${RS}..."
+    sudo install -Dm644 "$src/config.toml"        /etc/greetd/config.toml        && \
+    sudo install -Dm644 "$src/regreet.toml"       /etc/greetd/regreet.toml       && \
+    sudo install -Dm644 "$src/regreet.css"        /etc/greetd/regreet.css        && \
+    sudo install -Dm755 "$src/regreet-session.sh" /etc/greetd/regreet-session.sh && \
+        ok "greetd config deployed" || warn "greetd config deploy had errors"
+}
+
 sync_configs() {
     section "Config Sync"
 
     # ── Migration: old flat layout → hypr/usr/ ───────────────────────────────
     _migrate_hypr_usr
     _fix_hypr_usr
+    _deploy_greetd
 
     # ── Preferred: use the installed update-configs.sh ───────────────────────
     local cfg_script