polkit agent via user systemd unit, not XDG autostart

Second VM failure: Fedora's polkit-kde .desktop carries
X-systemd-skip=true (and OnlyShowIn on some versions), so niri's
xdg-desktop-autostart.target skips the agent regardless — package
installed, agent dead, same error.

Stop fighting .desktop semantics: install a polkit-agent.service USER
unit (WantedBy=graphical-session.target, which niri/Hyprland/Mango all
bring up) with the Fedora kf6 binary path, pre-linked into
graphical-session.target.wants. Idempotent on both file and symlink.

lib/session.sh

@@ -83,10 +83,12 @@ write_x11_session() {
 # Common login-time plumbing every Wayland compositor wants on a bare install.
 install_session_prereqs() {
     # polkit-kde ships the agent (polkit-gnome is orphaned, EPEL-only).
-    # BUT its autostart file has OnlyShowIn=KDE; — XDG autostart SKIPS it in a
-    # niri/Hyprland/MangoWC session (VM-proven: package installed, error
-    # persisted). Copy the .desktop without the OnlyShowIn line so the agent
-    # starts in every session; the copy shadows the original by name.
+    # BUT Fedora's autostart .desktop carries X-systemd-skip=true (and a
+    # OnlyShowIn on some versions): niri starts apps via systemd's
+    # xdg-desktop-autostart.target, which honors those flags -> agent never
+    # starts in a niri session (VM-proven twice). Fighting .desktop semantics
+    # is fragile, so we ship our own user unit bound to
+    # graphical-session.target, which niri/Hyprland/MangoWC all bring up.
     install_packages \
         xdg-desktop-portal \
         polkit \
@@ -95,13 +97,32 @@ install_session_prereqs() {
         pipewire-pulseaudio \
         wireplumber
 
-    local src="${POLKIT_AGENT_DESKTOP:-/etc/xdg/autostart/polkit-kde-authentication-agent-1.desktop}"
-    local dst="${XDG_AUTOSTART_DIR:-/etc/xdg/autostart}/polkit-kde-authentication-agent-1.desktop"
-    # src and dst are the same file in production — the condition to rewrite
-    # is "the file still contains OnlyShowIn", not "dst lacks it".
-    if [[ -f "$src" ]] && grep -q "^OnlyShowIn=" "$src" 2>/dev/null; then
-        info "Making polkit agent session-agnostic (stripping OnlyShowIn=KDE)..."
-        sudo mkdir -p "$(dirname "$dst")"
-        grep -v '^OnlyShowIn=' "$src" | sudo tee "$dst" >/dev/null
+    local unit_dir="/etc/systemd/user"
+    if [[ ! -f "$unit_dir/polkit-agent.service" ]]; then
+        info "Installing polkit-agent user unit (compositor-safe)..."
+        sudo mkdir -p "$unit_dir"
+        sudo tee "$unit_dir/polkit-agent.service" >/dev/null <<'UNIT'
+[Unit]
+Description=PolicyKit Authentication Agent (for bare compositors)
+PartOf=graphical-session.target
+
+[Service]
+# polkit-kde's binary on Fedora (kf6 path). Restart in case the agent dies
+# before the session settles.
+ExecStart=/usr/libexec/kf6/polkit-kde-authentication-agent-1
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=graphical-session.target
+UNIT
+    fi
+
+    # Enable per-user: preset-all would also do, but be explicit. This is a
+    # global unit dir; each user links it at first login via the preset.
+    if [[ ! -f /etc/systemd/user/graphical-session.target.wants/polkit-agent.service ]]; then
+        sudo mkdir -p /etc/systemd/user/graphical-session.target.wants
+        sudo ln -sf ../polkit-agent.service \
+            /etc/systemd/user/graphical-session.target.wants/polkit-agent.service
     fi
 }