Lock when a closed-lid session loses its last external display

[Chessing234]

Summary

• Closed-lid clamshell sessions stayed unlocked after the last external monitor disappeared, so the focused client kept taking keyboard input with no visible output (Closed-lid session stays unlocked and accepts invisible input after its last external monitor disconnects #9301).
• Share that secure-state rule between lid-close and clamshell reconcile, and lock before re-enabling the internal panel on undock.
• Cover the new path with shell tests alongside the existing lid-close cases.

Test plan

• bash test/shell.d/lid-close-test.sh
• bash test/shell.d/clamshell-undock-lock-test.sh
• On a laptop: close lid on one external, disconnect that external, confirm the session locks before input is accepted again

Fixes #9301