qemu/libvirt belongs to the advanced menu, not the niri module

A clean-snapshot run showed qemu/virt-manager installed without choosing
it: PR #4 had embedded the install in the niri module. Removed from there
(zero virt packages in a plain niri run, harness-verified) and moved into
install_category_pkgs Virtualisation: picking qemu/virt-manager there now
also enables libvirtd and adds the user to the libvirt group.

modules/twm/niri.sh

@@ -28,14 +28,4 @@ install_nerd_font JetBrainsMono
 install_packages sddm
 switch_display_manager sddm
 
-# virt-manager/qemu:///system without password prompts: libvirt group +
-# enabled daemon. Group membership applies to NEW sessions (re-login).
-install_optional qemu-kvm libvirt virt-install virt-manager virt-viewer
-if pkg_installed libvirt; then
-    info "Enabling libvirtd and adding $USER to the libvirt group..."
-    sudo systemctl enable --now libvirtd 2>/dev/null || true
-    sudo usermod -aG libvirt "$USER" || true
-    info "Group membership applies after re-login."
-fi
-
 ok "Niri setup complete. Log out and pick Niri in SDDM."

setup.sh

@@ -533,6 +533,20 @@ run_advanced_menu() {
 install_category_pkgs() {
     local cat="$1"; shift
     case "$cat" in
+        Virtualisation)
+            # qemu:///system without password prompts: libvirt group + enabled
+            # daemon. Only when the picked packages actually use libvirt.
+            local wants_libvirt=false item
+            for item in "$@"; do
+                [[ "$item" == *libvirt* || "$item" == *virt-manager* || "$item" == *virt-install* ]] && wants_libvirt=true
+            done
+            if $wants_libvirt; then
+                info "Enabling libvirtd and adding $USER to the libvirt group..."
+                sudo systemctl enable --now libvirtd 2>/dev/null || true
+                sudo usermod -aG libvirt "$USER" || true
+                warn "libvirt group membership applies after re-login."
+            fi
+            ;;
         Browsers)
             local needs_chrome=false needs_brave=false item
             for item in "$@"; do