Make the lock screen follow the colour scheme

hyprlock.conf shipped with Tokyo Night Moon hardcoded in six places, so
choosing light mode left the lock screen dark. Every other surface had
been taught to follow the scheme this week -- kitty, GTK, the launcher,
btop, tmux, neovim -- and this was the one left, which is unfortunate,
because it is the screen a user sees most often and the worst possible
place to find a theming bug: you discover it while locked out of the
machine and cannot fix it from there.

It is now generated from a template on every scheme change, the same
shape kitty, GTK, tmux and btop already use, and seeded by link-dotfiles
so the first lock of a fresh install is themed rather than falling back
to hyprlock's bare grey default. hyprlock is launched fresh on each lock
(`pidof hyprlock || hyprlock`), so it picks the file up with no restart.

The dark output is byte-identical to the file it replaces, ignoring
comments -- verified by diff -- so nothing changes for anyone already in
dark mode.

One detail worth recording: hyprlock takes rgba(r, g, b, a) in DECIMAL,
not hex, so the template carries "R, G, B" triples where every other
theme file in this repository uses hex. Two values are the exception,
sitting inside Pango markup where hyprlock wants ##rrggbb. Getting
either wrong is not a parse error -- hyprlock ignores the value and uses
its own default, silently.

Which is why this has a contract. It generates both schemes into a
fixture, never the live config, and checks that no placeholder survives
substitution, that every colour is a well-formed decimal triple, that
the Pango values are well-formed hex, that a light lock screen is
actually light, and that the two schemes differ at all. Verified it
catches a hardcoded colour left in the template and a light mode built
from the dark palette, which is the original bug exactly.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/hypr/hyprlock.conf.template

@@ -1,8 +1,17 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# hyprlock — lock screen
+# hyprlock — lock screen.
 #
-# Tokyo Night Moon, matching quickshell/config/Theme.qml:
-#   accent  #82aaff    fg  #c8d3f5    dim  #828bb8    bg  #222436    red #ff757f
+# GENERATED FILE. Edit hyprlock.conf.template and re-run
+# quickshell/scripts/panama-theme-apps; editing this copy is overwritten on the
+# next colour scheme change.
+#
+# The colours here follow the desktop's light/dark setting. They used to be
+# hardcoded Tokyo Night Moon, which meant the one screen you see most often
+# stayed dark when everything else went light.
+#
+# hyprlock takes rgba(r, g, b, a) in DECIMAL rather than hex, which is why the
+# template carries "R, G, B" triples where the rest of Panama uses hex. The two
+# Pango markup values are the exception and want ##rrggbb.
 #
 # hyprlang syntax, not Lua — hyprlock is a separate project from Hyprland.
 # ─────────────────────────────────────────────────────────────────────────────
@@ -45,7 +54,7 @@ background {
     vibrancy_darkness = 0.05
 
     # Shown if the screenshot is unavailable.
-    color = rgba(34, 36, 54, 1.0)
+    color = rgba(@BG@, 1.0)
 
     zindex = -1
 }
@@ -54,7 +63,7 @@ background {
 label {
     monitor =
     text = cmd[update:1000] date +"%-I:%M"
-    color = rgba(200, 211, 245, 1.0)
+    color = rgba(@FG@, 1.0)
     font_size = 120
     font_family = Adwaita Sans Light
     position = 0, 260
@@ -65,7 +74,7 @@ label {
 label {
     monitor =
     text = cmd[update:60000] date +"%A, %B %-d"
-    color = rgba(130, 139, 184, 1.0)
+    color = rgba(@MUTED@, 1.0)
     font_size = 24
     font_family = Adwaita Sans
     position = 0, 160
@@ -84,18 +93,18 @@ input-field {
     outline_thickness = 2
     rounding = 26
 
-    outer_color = rgba(130, 170, 255, 0.9)
-    inner_color = rgba(46, 47, 61, 0.85)
-    font_color = rgba(200, 211, 245, 1.0)
-    check_color = rgba(130, 170, 255, 1.0)
-    fail_color = rgba(255, 117, 127, 1.0)
+    outer_color = rgba(@ACCENT@, 0.9)
+    inner_color = rgba(@FIELD@, 0.85)
+    font_color = rgba(@FG@, 1.0)
+    check_color = rgba(@ACCENT@, 1.0)
+    fail_color = rgba(@ERROR@, 1.0)
 
     dots_size = 0.25
     dots_spacing = 0.3
     dots_center = true
 
-    placeholder_text = <span foreground="##828bb8"><i>Password</i></span>
-    fail_text = <span foreground="##ff757f"><i>$FAIL ($ATTEMPTS)</i></span>
+    placeholder_text = <span foreground="##@MUTED_HEX@"><i>Password</i></span>
+    fail_text = <span foreground="##@ERROR_HEX@"><i>$FAIL ($ATTEMPTS)</i></span>
 
     fade_on_empty = false
     hide_input = false
@@ -105,7 +114,7 @@ input-field {
 label {
     monitor =
     text = $USER
-    color = rgba(200, 211, 245, 0.9)
+    color = rgba(@FG@, 0.9)
     font_size = 16
     font_family = Adwaita Sans
     position = 0, -110

config/dot/quickshell/scripts/panama-theme-apps

@@ -31,6 +31,59 @@ case "$scheme" in
     *) printf 'usage: panama-theme-apps [dark|light]\n' >&2; exit 2 ;;
 esac
 
+# ── hyprlock ─────────────────────────────────────────────────────────────────
+# The lock screen. hyprlock is launched fresh on every lock (`pidof hyprlock ||
+# hyprlock`), so it reads this file each time and needs no restart.
+#
+# It takes rgba(r, g, b, a) in DECIMAL, not hex, so the palette is expressed as
+# "R, G, B" triples here rather than the hex used everywhere else. The two
+# _HEX values are the exception: they sit inside Pango markup, where hyprlock
+# wants ##rrggbb.
+lock_dir="${XDG_CONFIG_HOME:-$HOME/.config}/hypr"
+lock_template="$lock_dir/hyprlock.conf.template"
+
+if [[ "$scheme" == "light" ]]; then
+    lock_fg="55, 96, 191"        # #3760bf
+    lock_muted="97, 114, 176"    # #6172b0
+    lock_accent="46, 125, 233"   # #2e7de9
+    lock_error="245, 42, 101"    # #f52a65
+    lock_bg="225, 226, 231"      # #e1e2e7
+    lock_field="208, 213, 227"   # #d0d5e3
+    lock_muted_hex="6172b0"
+    lock_error_hex="f52a65"
+else
+    lock_fg="200, 211, 245"      # #c8d3f5
+    lock_muted="130, 139, 184"   # #828bb8
+    lock_accent="130, 170, 255"  # #82aaff
+    lock_error="255, 117, 127"   # #ff757f
+    lock_bg="34, 36, 54"         # #222436
+    lock_field="46, 47, 61"      # #2e2f3d
+    lock_muted_hex="828bb8"
+    lock_error_hex="ff757f"
+fi
+
+status_hyprlock="skipped"
+if [[ -r "$lock_template" ]]; then
+    # Written atomically: a lock triggered mid-write would otherwise read a
+    # truncated config and fall back to hyprlock's own defaults, which is a
+    # bright grey screen with none of this desktop's identity.
+    if sed -e "s/@FG@/$lock_fg/g" \
+           -e "s/@MUTED@/$lock_muted/g" \
+           -e "s/@ACCENT@/$lock_accent/g" \
+           -e "s/@ERROR@/$lock_error/g" \
+           -e "s/@BG@/$lock_bg/g" \
+           -e "s/@FIELD@/$lock_field/g" \
+           -e "s/@MUTED_HEX@/$lock_muted_hex/g" \
+           -e "s/@ERROR_HEX@/$lock_error_hex/g" \
+           "$lock_template" >"$lock_dir/hyprlock.conf.tmp" 2>/dev/null \
+        && mv "$lock_dir/hyprlock.conf.tmp" "$lock_dir/hyprlock.conf" 2>/dev/null; then
+        status_hyprlock="written"
+    else
+        rm -f "$lock_dir/hyprlock.conf.tmp"
+        status_hyprlock="failed"
+    fi
+fi
+
 # ── tmux ─────────────────────────────────────────────────────────────────────
 # Generated like kitty's: tmux.conf sources current-theme.conf, and that file is
 # machine state rather than configuration. Running servers are re-sourced so an
@@ -146,4 +199,5 @@ jq -cn \
     --arg gtk "$status_gtk" \
     --arg btop "$status_btop" \
     --arg tmux "$status_tmux" \
-    '{scheme: $scheme, kitty: $kitty, gtk: $gtk, btop: $btop, tmux: $tmux}'
+    --arg hyprlock "$status_hyprlock" \
+    '{scheme: $scheme, kitty: $kitty, gtk: $gtk, btop: $btop, tmux: $tmux, hyprlock: $hyprlock}'