Add OpenVINO iGPU pipeline + forkserver guard + meson install fix

[dys0re]

Summary

Adds an optional OpenVINO inference pipeline that runs face detection and encoding on Intel integrated GPUs (Iris Xe / UHD / Arc), replacing the CPU-bound dlib HOG/CNN + ResNet path. Also includes two follow-up fixes that are required for the OpenVINO path to actually work end-to-end.

Three commits, each independently reviewable:

1. feat: add OpenVINO iGPU face detection and encoding pipeline

• New module howdy/src/openvino_face.py exposing FaceDetector and FaceEncoder built on top of OpenVINO's Core:
  • Detection: face-detection-adas-0001 (SSD-based)
  • Encoding: face-reidentification-retail-0095 (256-dim embedding)
• Compiled GPU models are cached under /var/cache/howdy/openvino/ for fast startup.
• Detection results are converted to dlib.rectangle so the rest of the pipeline is unchanged.
• Activated by the existing use_cnn = true config; automatic fallback to dlib if OpenVINO or the model files are unavailable.
• OpenVINO is imported lazily (not at module load time) to avoid interfering with OpenCV's V4L2 backend in PAM environments.
• New howdy/src/openvino-models/install.sh downloads the FP16 IR files on demand.

2. fix: guard compare.py and cli.py against forkserver re-import

This is the critical bug fix. Without it, PAM howdy fails on every authentication attempt when OpenVINO ≥ 2026.x is installed.

OpenVINO 2026.x's GPU runtime uses multiprocessing.forkserver to spawn worker processes. forkserver starts each worker by calling spawn.import_main_path(main_path), which re-executes the entry script under the name __mp_main__.

howdy's entry scripts (compare.py for PAM, cli.py for the howdy command) have all logic at module top level with no if __name__ == "__main__" guard, so every forkserver worker re-ran the entire script and tried to reopen the camera:

worker reads config
worker calls VideoCapture(config)        <-- open /dev/video<id>
open fails with EBUSY                    <-- UVC camera is exclusive
"Failed to read camera specified..."
worker sys.exit(14)

The forkserver worker crashing during import destabilises the parent's OpenVINO inference path, causing pam_howdy to exceed the configured timeout. End-user symptom under sudo / login:

pam_howdy[...]: Failure, unknown error 120
pam_howdy[...]: Failure, timeout reached
pam_howdy[...]: Failure, not possible to open camera at configured path

Reproduced via strace -f: a single compare.py dry run spawned 131 PIDs, with forkserver workers repeatedly attempting openat("/dev/video2") and hitting EBUSY.

Fix: exit early when __name__ != "__main__". Normal invocation has __name__ == "__main__" and is unaffected. This is the standard Python multiprocessing "guard your __main__" pattern.

3. fix(meson): install openvino-models/install.sh to datadir

Commit 1 added openvino-models/install.sh and the README instructs users to run sudo bash /usr/share/howdy/openvino-models/install.sh, but meson.build only added openvino_face.py to py_sources — the script was never installed. Now installed to <datadir>/howdy/openvino-models/ matching the existing dlib-data/install.sh pattern.

---

Benchmark

Dell Latitude 7420, i7-1185G7, Iris Xe, IR camera, Fedora 44, OpenVINO 2026.2.1, Python 3.14.6:

Pipeline	FPS	Auth time	CPU usage
dlib HOG (CPU)	~15	~3 s	1 core 100%
dlib CNN (CPU)	<1	timeout	1 core 100%
OpenVINO (iGPU)	~30	~1.6 s	minimal

Measured pam_howdy outcomes (journalctl), 4 consecutive sudo invocations, same hardware:

	Before forkserver guard	After guard
Login approved	0 / 4	4 / 4
Failure, ...	4 / 4	0 / 4

Cosine-distance certainty under OpenVINO (30-frame sample, IR camera, single subject): median 0.22–0.28, min 0.15, max 0.36; current default threshold certainty = 4.5 (= 0.45) has comfortable margin.

---

Compatibility notes

• Encoding dimensions change from 128 (dlib) to 256 (OpenVINO). Existing user models encoded by dlib are not comparable with OpenVINO embeddings. Users switching to the OpenVINO path must re-enroll (howdy clear && howdy add). The two paths use different distance metrics (L2 vs cosine) so mixing them is not safe.
• use_cnn = true is reused as the activation switch. If a future maintainer prefers a dedicated use_openvino option I'm happy to refactor — kept the reuse to minimise config surface.
• OpenVINO ≥ 2026.x triggers the forkserver behaviour that commit 2 guards against. Earlier OpenVINO versions don't use forkserver and work without the guard, but the guard is a no-op for them, so it's safe to apply unconditionally.
• Only the entry scripts (compare.py, cli.py) need the guard. Subcommand modules under cli/ are imported via import cli.add etc., not re-executed by forkserver, so they don't need it.
• face-detection-adas-0001 was trained on visible-light data and shows reduced recall (~30% per-frame) on pure IR frames processed via grayscale→BGR; in practice this is fine because the PAM timeout budget allows ~60 frames per authentication. Adding landmark-based face alignment (the model card for face-reidentification-retail-0095 recommends it) would further improve precision and is left as future work.

---

Files changed

File	Change
howdy/src/openvino_face.py	new — OpenVINO detector/encoder module
howdy/src/openvino-models/install.sh	new — model downloader script
howdy/src/compare.py	mod — use OpenVINO pipeline + forkserver guard
howdy/src/cli.py	mod — forkserver guard
howdy/src/cli/add.py	mod — use OpenVINO pipeline for enrollment
howdy/src/cli/test.py	mod — use OpenVINO pipeline for test mode
howdy/src/recorders/video_capture.py	mod — V4L2 open fallback for PAM
howdy/src/meson.build	mod — install openvino_face.py and openvino-models/install.sh

Happy to split this into smaller PRs (e.g. land commit 2 standalone first since it's an unconditional correctness fix for any user on OpenVINO ≥ 2026.x) if the maintainer prefers.