[Bug]: Fresh Cinnamon install adds user to nopasswdlogin — screen lock never prompts for a password.

### Kernel

7.0.12-1-cachos

### Desktop Environment / Window Manager

Cinnamon v6.6.8, Muffin X11.

### CPU

AMD Ryzen 5 4600H (12) @ 3.00 GHz

### GPU / Driver

NVIDIA GeForce GTX 1650 Mobile / Max-Q [Discrete]

### Description

On a fresh CachyOS Cinnamon install with autologin not selected, the user account is placed in the nopasswdlogin group. As a result, the Cinnamon lock screen (Super+L or on suspend) shows the screensaver but unlocks on any input without requesting a password — i.e. the lock screen provides no protection. Removing the user from the group (sudo gpasswd -d nopasswdlogin) restores normal password-on-unlock behaviour.

Impact: Security. A default desktop install gives no lock-screen protection, with no autologin choice having been made to imply it.

Steps to reproduce: 1) Fresh install, Cinnamon edition, autologin disabled. 2) Lock the session (Super+L). 3) Press a key / click — session unlocks with no password prompt.

Evidence:

getent group nopasswdlogin lists the user (on a fresh install).
grep -rn nopasswdlogin /etc/pam.d/
autologin config

See also:

https://discuss.cachyos.org/t/cachyos-not-asking-for-password-on-computer-lock/20063

https://discuss.cachyos.org/t/os-unlocked-without-asking-for-password/20127

### Steps to Reproduce

1) Fresh install, Cinnamon edition, autologin disabled.

2) Lock the session (Super+L).

3) Press a key / click — session unlocks with no password prompt.

### Expected Behavior

The screen should lock and ask for a password on unlock.

### Actual Behavior

The screensaver starts, shows a clock, but does not ask for any password on unlock.

### Logs / Error Messages

https://paste.cachyos.org/p/14f6726.log

### Additional Context

https://paste.cachyos.org/p/14f6726.log

Reproduce the issue on a fresh Cinnamon install with autologin disabled, then inspect the user’s nopasswdlogin membership with getent group and review the references in /etc/pam.d/ and the autologin config. Compare the configuration with the expected lock-screen behavior. Done means a non-autologin user is not treated as nopasswdlogin and the screen lock requires a password.

Written by the indexing model from the issue text.