Polkit agent for compositor sessions; libvirt group for virt-manager

virt-manager on niri/Noctalia failed with 'authentication unavailable:
no polkit agent available to authenticate action org.libvirt.unix.manage'
- bare compositors ship no polkit agent, unlike GNOME/KDE.

Two fixes:
- install_session_prereqs installs polkit-gnome and wires its agent
  .desktop into /etc/xdg/autostart (paths overridable for testing).
- niri module optionally installs the qemu/libvirt stack, enables
  libvirtd, and adds the user to the libvirt group: members manage
  qemu:///system with no polkit prompt at all (the real fix; applies
  after re-login).

lib/session.sh

@@ -85,7 +85,21 @@ install_session_prereqs() {
     install_packages \
         xdg-desktop-portal \
         polkit \
+        polkit-gnome \
         pipewire \
         pipewire-pulseaudio \
         wireplumber
+
+    # A bare compositor (niri, MangoWC, Hyprland) has NO polkit agent: without
+    # one, anything needing privilege elevation (virt-manager's libvirt access,
+    # disks, network settings) fails with "no polkit agent available to
+    # authenticate". Autostart it for every graphical session via the XDG
+    # autostart dir the session runs.
+    local autostart="${XDG_AUTOSTART_DIR:-/etc/xdg/autostart}"
+    local desktop_src="${POLKIT_AGENT_DESKTOP:-/usr/share/applications/polkit-gnome-authentication-agent-1.desktop}"
+    if [[ -f "$desktop_src" ]] && [[ ! -e "$autostart/$(basename "$desktop_src")" ]]; then
+        info "Enabling polkit agent for compositor sessions..."
+        sudo mkdir -p "$autostart"
+        sudo ln -sf "$desktop_src" "$autostart/$(basename "$desktop_src")"
+    fi
 }

modules/twm/niri.sh

@@ -28,4 +28,14 @@ install_nerd_font JetBrainsMono
 install_packages sddm
 switch_display_manager sddm
 
+# virt-manager/qemu:///system without password prompts: libvirt group +
+# enabled daemon. Group membership applies to NEW sessions (re-login).
+install_optional qemu-kvm libvirt virt-install virt-manager virt-viewer
+if pkg_installed libvirt; then
+    info "Enabling libvirtd and adding $USER to the libvirt group..."
+    sudo systemctl enable --now libvirtd 2>/dev/null || true
+    sudo usermod -aG libvirt "$USER" || true
+    info "Group membership applies after re-login."
+fi
+
 ok "Niri setup complete. Log out and pick Niri in SDDM."