Polkit agent for compositor sessions; libvirt group for virt-manager

virt-manager on niri/Noctalia failed with 'authentication unavailable:
no polkit agent available to authenticate action org.libvirt.unix.manage'
- bare compositors ship no polkit agent, unlike GNOME/KDE.

Two fixes:
- install_session_prereqs installs polkit-gnome and wires its agent
  .desktop into /etc/xdg/autostart (paths overridable for testing).
- niri module optionally installs the qemu/libvirt stack, enables
  libvirtd, and adds the user to the libvirt group: members manage
  qemu:///system with no polkit prompt at all (the real fix; applies
  after re-login).

lib/session.sh

@@ -85,7 +85,21 @@ install_session_prereqs() {
     install_packages \
         xdg-desktop-portal \
         polkit \
+        polkit-gnome \
         pipewire \
         pipewire-pulseaudio \
         wireplumber
+
+    # A bare compositor (niri, MangoWC, Hyprland) has NO polkit agent: without
+    # one, anything needing privilege elevation (virt-manager's libvirt access,
+    # disks, network settings) fails with "no polkit agent available to
+    # authenticate". Autostart it for every graphical session via the XDG
+    # autostart dir the session runs.
+    local autostart="${XDG_AUTOSTART_DIR:-/etc/xdg/autostart}"
+    local desktop_src="${POLKIT_AGENT_DESKTOP:-/usr/share/applications/polkit-gnome-authentication-agent-1.desktop}"
+    if [[ -f "$desktop_src" ]] && [[ ! -e "$autostart/$(basename "$desktop_src")" ]]; then
+        info "Enabling polkit agent for compositor sessions..."
+        sudo mkdir -p "$autostart"
+        sudo ln -sf "$desktop_src" "$autostart/$(basename "$desktop_src")"
+    fi
 }