fix: lock-screen, confirm-tier, and mail-folder audit bugs

Lock screen: slock is X11-only and never grabbed the Wayland session, so C-; ! l silently did nothing. On Wayland the locker now runs loginctl lock-session, which logind turns into a Lock signal that hypridle handles by running hyprlock, the same path idle and before-sleep locking already use. X11 keeps slock. system-commands.el now also requires host-environment, which it used at load time but never declared.

Confirmation tier: the global (fset 'yes-or-no-p 'y-or-n-p) plus use-short-answers t both flattened yes-or-no-p to a single keystroke, so the deliberate strong-confirm tier for irreversible actions was dead. A stray space could power off the machine or destroy files. I added cj/confirm-strong, which binds use-short-answers nil for one call to force a typed "yes", and routed the six irreversible sites through it (shutdown/reboot, permanent file destruction, file overwrites). I dropped the redundant fset and kept use-short-answers t so ordinary prompts stay single-key.

Mail folders: the cmail context set no trash folder, so D fell back to a nonexistent /trash, and no context set a refile folder, so r targeted a nonexistent /archive everywhere. Accepting mu4e's offer to create the maildir stranded mail where mbsync never syncs it. cmail now trashes to /cmail/Trash. Refile is computed per message rather than per context, because mu4e context :vars are sticky and a per-context refile would leak one account's archive folder into another. cmail archives to /cmail/Archive. The Gmail-backed accounts have no synced archive maildir, so they signal rather than move mail into an unsynced folder.

Lock and confirm-tier need a daemon restart to fully take effect. The mail changes apply on next mu4e open.

1 files changed, 2 insertions, 1 deletions

diff --git a/modules/dwim-shell-config.el b/modules/dwim-shell-config.el
index 57eea7063..655c8d852 100644
--- a/modules/dwim-shell-config.el
+++ b/modules/dwim-shell-config.el
@@ -98,6 +98,7 @@
 ;;; Code:
 
 (require 'cl-lib)
+(require 'system-lib)  ;; cj/confirm-strong (permanent file destruction confirm)
 
 ;; --------------------------- Password-file helpers ---------------------------
 
@@ -801,7 +802,7 @@ switching off the .7z format to gpg-wrapped tar."
 Uses =shred -u= so the file is unlinked after overwriting, matching the
 \"delete\" the command name and prompt promise."
 	(interactive)
-	(when (yes-or-no-p "This will permanently destroy files. Continue? ")
+	(when (cj/confirm-strong "This will permanently destroy files. Continue? ")
 	  (dwim-shell-command-on-marked-files
 	   "Secure delete"
 	   "shred -vfzu -n 3 '<<f>>'"