I'm not sure what it defaults to, but if it defaults to anything else than system-auth, then it's broken and has to be fixed :) Another option is to get it to default to a libhome pam.d file and then make that mimic system-auth, but it sounds too complicated rather than just setting the default to system-auth, considering that it is configurable.
no idea why common-lisp is in metadata ... it defaults to "other", which is a sane default here IMO
other -> HAS to remain pam_deny for everything. Not a good default in my opinion...
i was wrong after all, it doesn't have a default pam module, instead the user configures which one should be used in a custom home.conf (none is installed by the ebuild)