v7

What's Changed

• Bump tract to 0.23 to drop unmaintained anymap2 by @karanshukla in #135
• deploy.sh: install an archive OpenVINO runtime root-owned, and run from the checkout by @karanshukla in #133
• uninstall: clean PAM before removing binaries, strip our line instead of restoring backups by @karanshukla in #138
• release: build with a read-only token, publish in a separate job by @karanshukla in #137
• Fail closed when no IR camera is found instead of guessing /dev/video0 by @karanshukla in #141
• Treat only loopback PAM_RHOST as local, and refuse SSH sessions by default by @karanshukla in #142
• Enrol as root from the system config only, and validate --device by @karanshukla in #144
• Run getent by absolute path, fix a flaky pty test, correct store modes in the docs by @karanshukla in #145
• deploy: reject files SHA256SUMS doesn't list in the OpenVINO prefix; run ovfetch as the user by @karanshukla in #139
• Never auto-detect or accept a user-chosen virtual camera by @karanshukla in #134
• guard: protect everything but prose, and refuse a partial file list by @karanshukla in #136
• Count a failed attempt when the face is first seen, and lock the lockout state by @karanshukla in #143

Full Changelog: v6...v7